Lucene search
+L

42553 matches found

Snyk
Snyk
•added 2026/07/13 12:38 p.m.•7 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the scheme teams API endpoint. An attacker can access private team invite links and use them to join or share access to private teams by leveraging insufficient authorization checks. Remediation Upgrade...

5.1CVSS6.1AI score0.00255EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 11:55 a.m.•9 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the /share-channel autocomplete handler due to missing permission checks for managesharedchannels. An attacker can access remote cluster connection metadata by issuing autocomplete requests without the required...

5.3CVSS6.2AI score0.0027EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 11:55 a.m.•6 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the /share-channel autocomplete handler due to missing permission checks for managesharedchannels. An attacker can access remote cluster connection metadata by issuing autocomplete requests without the required...

5.3CVSS6.2AI score0.0027EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•8 views

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the shared channel inbound sync handler. An attacker can modify or delete posts belonging to other users by sending crafted synchronization messages that reference arbitrary post IDs i...

5.3CVSS6.2AI score0.00242EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•6 views

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the shared channel inbound sync handler. An attacker can modify or delete posts belonging to other users by sending crafted synchronization messages that reference arbitrary post IDs i...

5.3CVSS6.2AI score0.00242EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•6 views

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Incorrect Authorization via a mismatch between the channel referenced in an action cookie a...

7.1CVSS6.1AI score0.00299EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•12 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via a mismatch between the channel referenced in an action cookie and the channel of the target post. An attacker can perform unauthorized interactive post actions in private channels by using a cookie obtained...

7.1CVSS6.1AI score0.00299EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•6 views

Missing Authorization

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag ...

5.4CVSS6.1AI score0.00287EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•6 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...

5.4CVSS6.1AI score0.00287EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•7 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...

5.4CVSS6.1AI score0.00287EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•6 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...

5.4CVSS6.1AI score0.00287EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•7 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...

5.4CVSS6.1AI score0.00287EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•6 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...

5.4CVSS6.1AI score0.00287EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•10 views

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the magic-link token authentication process. An attacker can gain unauthorized access to a deactivated guest account by using a previously issued magic-link token. Remediation Upgrade...

5.4CVSS6.1AI score0.0023EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•6 views

Authentication Bypass by Primary Weakness

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the magic-link token authentication process. A...

5.4CVSS6.1AI score0.0023EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:40 a.m.•12 views

Server-side Request Forgery (SSRF)

Overview misp-modules is a MISP modules are autonomous modules that can be used for expansion and other services in MISP Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the htmltomarkdown process. An attacker can access internal network resources by supplyi...

8.3CVSS6.1AI score0.00405EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:39 a.m.•7 views

Authorization Bypass Through User-Controlled Key

Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the incoming webhook process. An...

6.9CVSS6.1AI score0.00361EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:39 a.m.•11 views

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the incoming webhook process. An attacker can impersonate another user and create posts or direct messages attributed to them by crafting specific webhook configurations and payloads...

6.9CVSS6.1AI score0.00361EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:39 a.m.•6 views

Authorization Bypass Through User-Controlled Key

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the incoming webhook process. An attacker can impersonate another user and create posts or...

6.9CVSS6.1AI score0.00361EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:39 a.m.•6 views

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the incoming webhook process. An attacker can impersonate another user and create posts or direct messages attributed to them by crafting specific webhook configurations and payloads...

6.9CVSS6.1AI score0.00361EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:38 a.m.•7 views

Authentication Bypass by Primary Weakness

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the OAuth refresh token grant process. An attacker can maintain unauthorized access by using a valid...

7.4CVSS6.1AI score0.00303EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:38 a.m.•7 views

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the OAuth refresh token grant process. An attacker can maintain unauthorized access by using a valid refresh token associated with a deactivated account. Remediation Upgrade...

7.4CVSS6.1AI score0.00303EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 10:16 a.m.•11 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unvalidated job template URI processing. An attacker can access internal network resources and cloud metadata endpoints by submitting crafted URIs through authenticated requests. Remediation Upgrade...

8.8CVSS5.3AI score0.00492EPSS
SaveExploits2References3
Snyk
Snyk
•added 2026/07/13 10:00 a.m.•7 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the gateway component's authorization handling when the query RBAC feature is enabled. An attacker can access sensitive span attributes from other tenants' namespaces by sending crafted requests to the query...

7.1CVSS6.1AI score0.00354EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 8:30 a.m.•13 views

Malicious Package

Overview @nsub/nitxe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 8:17 a.m.•11 views

Malicious Package

Overview auto-debug-tool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 8:17 a.m.•36 views

Malicious Package

Overview prettier-plugin-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:49 a.m.•13 views

Malicious Package

Overview decimal-format-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:45 a.m.•7 views

Deserialization of Untrusted Data

Overview pyod is an A Python library for anomaly detection across tabular, time series, graph, text, image, and audio data. 61 detectors, benchmark-backed ADEngine orchestration, and an agentic workflow for AI agents. Affected versions of this package are vulnerable to Deserialization of Untruste...

6.5CVSS6.3AI score0.00441EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:30 a.m.•11 views

Malicious Package

Overview tipsen-last-pls is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:30 a.m.•10 views

Malicious Package

Overview tipsen-poc-again is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:30 a.m.•11 views

Malicious Package

Overview tipsen-last is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:30 a.m.•9 views

Malicious Package

Overview another-poc-by-tipsen is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:27 a.m.•14 views

Malicious Package

Overview sixseven8 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:27 a.m.•10 views

Malicious Package

Overview testdonotredeemit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:27 a.m.•12 views

Malicious Package

Overview sixseven7 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:27 a.m.•13 views

Malicious Package

Overview sixseven9 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:27 a.m.•11 views

Malicious Package

Overview sixseven10 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:27 a.m.•9 views

Malicious Package

Overview acidic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:23 a.m.•11 views

Malicious Package

Overview hbsig is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:22 a.m.•11 views

Malicious Package

Overview sequoia-engineering is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:12 a.m.•13 views

Malicious Package

Overview @gt-test-exp/profiler-exp-00000006 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:12 a.m.•11 views

Malicious Package

Overview @gt-test-exp/profiler-exp-00000008 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:12 a.m.•13 views

Malicious Package

Overview @gt-test-exp/profiler-exp-00000014 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:12 a.m.•14 views

Malicious Package

Overview @gt-test-exp/profiler-exp-00000011 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:12 a.m.•24 views

Malicious Package

Overview @gt-test-exp/profiler-exp-00000010 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:12 a.m.•21 views

Malicious Package

Overview @gt-test-exp/profiler-exp-00000009 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:12 a.m.•12 views

Malicious Package

Overview @gt-test-exp/profiler-exp-00000013 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:12 a.m.•10 views

Malicious Package

Overview @gt-test-exp/profiler-exp-00000012 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/07/13 6:12 a.m.•13 views

Malicious Package

Overview @gt-test-exp/profiler-exp-00000003 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.1AI score
SaveExploits0References2
Total number of security vulnerabilities42553