Malicious Package

Overview cdn-img-fetch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @praveenvjpm/color-utils-7210 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview hardhat-deep is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview function-color is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview hardhat-pack is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview centralogger is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Sensitive Information in Resource Not Removed Before Reuse

Overview org.postgresql:postgresql is a Java JDBC 4.2 JRE 8+ driver for PostgreSQL database. Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse in the ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or...

Not Failing Securely ('Failing Open')

Overview org.postgresql:postgresql is a Java JDBC 4.2 JRE 8+ driver for PostgreSQL database. Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' via the requireAuth property when it is configured to exclude all authentication methods or is left empty. An attack...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper handling of contradictory Key Usage and Extended Key Usage extensions during the certificate verification process. An attacker can gain unauthorized access to sensitive information by...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to incomplete validation in the X.509 certificate verification process. An attacker can cause unauthorized certificates to be accepted as valid by controlling a subordinate Certificate Authority and...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via improper hostname verification in the certificate validation process. An attacker can gain unauthorized access to sensitive information by presenting a crafted certificate that bypasses the Common Nam...

Denial of Service (DoS)

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Denial of Service DoS through the unbounded WebSocket permessage-deflate decompression process when compression is enabled. An attacker can...

Session Fixation

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Session Fixation incomplete validation of the ThreadSafeCookieStore process. An attacker can inject unauthorized cookies across trust domains...

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the Realm.Builder process when a Digest challenge is received without a usable nonce,...

Improper Authentication

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Improper Authentication in the CookieStore process. An attacker can gain unauthorized access to another user's session by exploiting the...

Origin Validation Error

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Origin Validation Error in the connection pooling process. An attacker can gain unauthorized access to sensitive data or perform actions with...

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the proxy connection process. An attacker can intercept sensitive credentials by acting a...

Sensitive Cookie with Improper SameSite Attribute

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute via improper validation of the Domain attribute in the cookie handling process. An attacker...

Incorrect Implementation of Authentication Algorithm

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm in the AuthenticatorUtils.computeExpectedRspAuth process. An attacker can impersonate a...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG in the Realm.Builder process, which generates the HTTP Digest client nonce...

Origin Validation Error

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Origin Validation Error in the connection pooling process. An attacker can gain unauthorized access to resources or perform actions as anothe...

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the ResponseFilter failover and retry process. An attacker can intercept sensitive...

Insufficient Verification of Data Authenticity

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the WebSocket handshake process. An attacker can cause unauthorized frames to be decoded an...

Cleartext Transmission of Sensitive Information

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the NettyRequestFactory.newNettyRequest process. An attacker can intercept proxy...

Embedded Malicious Code

Overview tensorlake is a TensorLake SDK for applications, sandboxes, and cloud services Affected versions of this package are vulnerable to Embedded Malicious Code that contains a credential-stealing worm known as Shai-Hulud. A malicious actor used a repository administrator account to commit the...

Insecure Temporary File

Overview Affected versions of this package are vulnerable to Insecure Temporary File in the process that extracts and loads the native library via net.jpountz.util.Native.load. An attacker can execute arbitrary code by pre-creating a malicious file in a shared temporary directory, causing the...

Insecure Temporary File

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Insecure Temporary File in the process that extracts and loads the native library via net.jpountz.util.Native.load. An attacker can execu...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the refill function when processing LZ4 block streams with stopOnEmptyBlock set to false. An attacker can cause a thread to terminate unexpectedly by providing a stream with a large number of consecutive empty...

Uncontrolled Recursion

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Uncontrolled Recursion in the refill function when processing LZ4 block streams with stopOnEmptyBlock set to false. An attacker can cause...

Allocation of Resources Without Limits or Throttling

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader process. An attacker can cause excessive CPU and garbage collection usage by providing specially...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via cross-request deduplication in the 'use cache' mechanism, where draft mode state is not accounted for when sharing cached fills between concurrent requests. A...

Origin Validation Error

Overview next is a react framework. Affected versions of this package are vulnerable to Origin Validation Error via the MCP middleware get-mcp-middleware.ts and the cross-site dev request blocker block-cross-site-dev.ts, which fail to adequately validate the request origin against the host. An...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys in the server's route caching logic in base-server.ts. Because cache keys are not bound to their source route, a...

SQL Injection

Overview @payloadcms/db-sqlite is a The officially supported SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are interpolat...

SQL Injection

Overview @payloadcms/db-postgres is a The officially supported Postgres database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are...

SQL Injection

Overview @payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are...

SQL Injection

Overview @payloadcms/db-vercel-postgres is a Vercel Postgres adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are interpolated into SQL...

Partial String Comparison

Overview Affected versions of this package are vulnerable to Partial String Comparison via the isPublicAdminRoute utility in packages/next/src/utilities/isPublicAdminRoute.ts, which incorrectly marks any route containing the substring /verify/ as a public admin route, regardless of whether it...

Missing Authorization

Overview @payloadcms/plugin-multi-tenant is a Multi Tenant plugin for Payload Affected versions of this package are vulnerable to Missing Authorization via the tenant field write path in tenantField/index.ts, where tenant membership is not enforced on create or update operations. An authenticated...

Origin Validation Error

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Origin Validation Error via getExternalFile in packages/payload/src/uploads/getExternalFile.ts, where the origin of an external file request URL is not validate...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-gcs is a Payload storage adapter for Google Cloud Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker c...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-s3 is a Payload storage adapter for Amazon S3 Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can upload a...

Cross-site Scripting (XSS)

Overview @payloadcms/payload-cloud is a The official Payload Cloud plugin Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can upload a...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-uploadthing is a Payload storage adapter for uploadthing Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker ca...

Cross-site Scripting (XSS)

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker can...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated...

Cross-site Scripting (XSS)

Overview @payloadcms/storage-azure is a Payload storage adapter for Azure Blob Storage Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient validation of upload file identity and XML/SVG content delivery in the uploads pipeline. An authenticated attacker c...

Incorrect Authorization

Overview @payloadcms/plugin-multi-tenant is a Multi Tenant plugin for Payload Affected versions of this package are vulnerable to Incorrect Authorization via the tenantField default value logic in packages/plugin-multi-tenant/src/fields/tenantField/index.ts, where the return value of...

External Control of File Name or Path

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to External Control of File Name or Path via the deleteAssociatedFiles function in packages/payload/src/uploads/deleteAssociatedFiles.ts, where a filename stored i...