Cross-site Request Forgery (CSRF)

Overview social-auth-core is a package that makes Python social authentication simple. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the authcomplete method in socialcore/backends/line.py the LINE OAuth2 backend, which does not call validatestate before...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the JobCodeController.save process when user-supplied input in the glueSource parameter is stored without output encoding, and subsequently rendered unescaped by the FreeMarker template job.code.ftl. An...

Uncaught Exception

Overview @libp2p/webrtc is an A libp2p transport using WebRTC connections Affected versions of this package are vulnerable to Uncaught Exception via the STUN listener in stun-listener.ts, where an unvalidated ufrag value from an incoming STUN request is passed directly into the native ICE stack a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the executorParam parameter in the POST /jobinfo/trigger endpoint. An attacker can execute arbitrary JavaScript in the context of another user's browser by injecting malicious scripts, potentially leading to...

Allocation of Resources Without Limits or Throttling

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the EventSourceStream transform in lib/web/eventsource/eventsource-stream.js, where the maxEventSize limit is onl...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception via excessive Content-Encoding headers in an HTTP response processed by httpNetworkFetch in lib/web/fetch/index.js. A server returning a response with...

Regular Expression Denial of Service (ReDoS)

Overview symfony/symfony is a PHP framework for web applications and a set of reusable PHP components. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via HeaderUtils::split in HeaderUtils.php, which uses a regular expression containing an ambiguous...

Regular Expression Denial of Service (ReDoS)

Overview symfony/http-foundation is a component defines an object-oriented layer for the HTTP specification. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via HeaderUtils::split in HeaderUtils.php, which uses a regular expression containing an...

Uncontrolled Recursion

Overview symfony/symfony is a PHP framework for web applications and a set of reusable PHP components. Affected versions of this package are vulnerable to Uncontrolled Recursion via Parser::lexInlineStructure, which recurses through lexInlineMapping and lexInlineSequence without incrementing the...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via Parser::lexInlineStructure, which recurses through lexInlineMapping and lexInlineSequence without incrementing the shared nesting-level counter that guards against excessive depth. Because the maxNestingLevel...

Uncontrolled Recursion

Overview symfony/symfony is a PHP framework for web applications and a set of reusable PHP components. Affected versions of this package are vulnerable to Uncontrolled Recursion via the expression parser in Parser.php, which builds a node tree with no bound on nesting depth. An attacker can suppl...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the expression parser in Parser.php, which builds a node tree with no bound on nesting depth. An attacker can supply an expression containing tens of thousands of nested unary operators, array literals, binary...

Incorrect Authorization

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

Malicious Package

Overview @flexmr/survey-conversation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview web-pixels-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview xapi-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview itsa-react-maskedinput is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @beloved-lenora/opencode-btw is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @beloved-lenora/opencode-todo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview parxleys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview itsa-react-focuscontainer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @xatancchii/natabaileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @beloved-lenora/opencode-shell-guard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview @beloved-lenora/opencode-stats is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview @beloved-lenora/opencode-goal is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @beloved-lenora/opencode-shared-rpc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview buyerdashboard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @flexmr/survey-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview asistenyorstore is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview xmd-baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview @beloved-lenora/opencode-orchestrator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview idlive-face-capture-web-development is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview @flexmr/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @developmentyora/yorakids is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview py-wormgpt is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview marocolor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview fromthehotel-poems is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview proxyrobika is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview getpubip is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview proxyrubika is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview proxy-rubikis is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Allocation of Resources Without Limits or Throttling

Overview io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WebSocket extension setup of HttpServerConnectionHandler and Http1ClientConnection, which...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception in the experimental WebSocket client, where a response failing handshake validation triggers an abort that is a no-op because the request is already...

Improper Protection of Alternate Path

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Improper Protection of Alternate Path via the find function in lib/util/host-rules.ts, where administrator-configured HTTP headers such as authentication credentials for one host can be sent to a...

Brute Force

Overview @better-auth/drizzle-adapter is a Drizzle adapter for Better Auth Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED isolation, the WHE...

Brute Force

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED...

Brute Force

Overview @better-auth/kysely-adapter is a Kysely adapter for Better Auth Affected versions of this package are vulnerable to Brute Force via a race condition in the compare-and-swap UPDATE path in drizzle-adapter.ts and relations-v2/index.ts. Under PostgreSQL's READ COMMITTED isolation, the WHERE...

Insufficient Control Flow Management

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Insufficient Control Flow Management via the branch processing logic in lib/workers/repository/update/branch/index.ts, when a rebase is requested on an open pull request that has pending updates, the...

Improper Authentication

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Improper Authentication via cross-purpose reuse of verification records, where a token issued for one authentication flow such as OAuth state or OAuth proxy...

Improper Authorization

Overview @better-auth/sso is a SSO plugin for Better Auth Affected versions of this package are vulnerable to Improper Authorization via the deleteSSOProvider route handler, which previously did not receive the options context required to enforce provider lifecycle guards. An authenticated attack...