Directory Traversal

Overview @fastify/static is a Plugin for serving static files as fast as possible. Affected versions of this package are vulnerable to Directory Traversal via the static file handler process. An attacker can access protected files by submitting requests with non-canonical path segments, such as d...

Authentication Bypass by Assumed-Immutable Data

Overview @neo4j/graphql is an A GraphQL to Cypher query execution layer for Neo4j and JavaScript GraphQL implementations Affected versions of this package are vulnerable to Authentication Bypass by Assumed-Immutable Data in the connectionParams.jwt process. An attacker can gain unauthorized acces...

Malicious Package

Overview streak-cache-map is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview statist-statist-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the nameAndService resolver in pkg/provider/kubernetes/crd/kuberneteshttp.go. An attacker can bind an IngressRoute in their own namespace to another namespace's TraefikService by supplying a @kubernetescrd...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the nameAndService resolver in pkg/provider/kubernetes/crd/kuberneteshttp.go. An attacker can bind an IngressRoute in their own namespace to another namespace's TraefikService by supplying a @kubernetescrd...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling through the CONNECT handling path and the shared backend transport. An attacker can make another client read attacker-smuggled backend output by sending an HTTP/2 or HTTP/3 CONNECT request with a body that Traefik...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling through the CONNECT handling path and the shared backend transport. An attacker can make another client read attacker-smuggled backend output by sending an HTTP/2 or HTTP/3 CONNECT request with a body that Traefik...

Malicious Package

Overview tsihealth-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview jagproject is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via filename handling in the Gitblame, Hgblame, and Svnblame report generators. An attacker can execute arbitrary shell commands by supplying an untrusted file whose name contains shell metacharacters. When...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the uri.Open and migration asset download paths in modules/uri/uri.go and services/migrations/dump.go. An attacker can make the server fetch internal services, cloud metadata, or local files by...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the /management/stop handler in the metrics management server on port 9091. An attacker can terminate the proxy, datanode, or querynode by sending a crafted HTTP GET request to...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the /management/stop handler in the metrics management server on port 9091. An attacker can terminate the proxy, datanode, or querynode by sending a crafted HTTP GET request to...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the /management/stop handler in the metrics management server on port 9091. An attacker can terminate the proxy, datanode, or querynode by sending a crafted HTTP GET request to...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through improper namespace resolution in the extensionRef process. An attacker can cause unauthorized middleware from a backend namespace to be bound to a route by crafting a malicious HTTPRoute with...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through improper namespace resolution in the extensionRef process. An attacker can cause unauthorized middleware from a backend namespace to be bound to a route by crafting a malicious HTTPRoute with...

Allocation of Resources Without Limits or Throttling

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the island renderer endpoint when attacker-controlled input is decoded and hashed before URL-resident hash validation. An...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the island renderer endpoint when attacker-controlled input is decoded and hashed before URL-resident hash validation. An attacker can exhaust CPU resources and degrade or stall t...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the island renderer endpoint when attacker-controlled input is decoded and hashed before URL-resident hash validation. An attacker can exhaust CPU...

Malicious Package

Overview svelte-mapped-metrics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @agenthub-ai/agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview npm-dc-dev is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @nasddatax/common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview simplipayng is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview @simplipayng/checkout is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tinkoff-fb-app-frame-page-height-dippy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview sso-tramvai-lib-roles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview statist-browser-typed-client-rubliq.platform.keycloak is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between th...

Malicious Package

Overview bnpl-blocks-atom-bnpl-dolyame-button is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview bnpl-blocks-atom-bnpl-action-card is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization,...

Malicious Package

Overview bnpl-blocks-atom-bnpl-email-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @lizhao1/memorax-code-internal is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview cdk-insights is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview patchwork-os is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview twork-data-services-sme-agent-company-relation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview bnpl-blocks-atom-bnpl-info-card is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview vvvedernikov-test-another-test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview bnpl-blocks-atom-bnpl-anchor-menu is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @zahlen/checkout is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview bigops-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview decapod-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview eth-account-wallet is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview kepler is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...