Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk15to18 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the PBEPBKDF2 implementation in...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the org.bouncycastle.openpgp.api streaming decryption path and the AEAD decryption streams. An attacker can cause decrypted plaintext to be accepted without an error, or have following...

Protection Mechanism Failure

Overview Magick.NET-Q8-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Protection Mechanism Failure

Overview Magick.NET-Q16-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Protection Mechanism Failure

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Protection Mechanism Failure

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Protection Mechanism Failure

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the LoadPolicyCache process when policy.xml uses an alternate DOCTYPE. An attacker can bypass security policy enforcement by crafting a policy.xml file with a DOCTYPE not ending in '', causing the parser ...

Cross-site Scripting (XSS)

Overview org.webjars.npm:showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the makehtml.image and makehtml.link sub-parsers, when processing inline links or images whose angle-bracket destination URL contains a...

Cross-site Scripting (XSS)

Overview showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the makehtml.image and makehtml.link sub-parsers, when processing inline links or images whose angle-bracket destination URL contains a double-quote...

Incorrect Authorization

Overview langgraph-sdk is a SDK for interacting with LangGraph API Affected versions of this package are vulnerable to Incorrect Authorization via the ResourceOn.call method in langgraphsdk/auth/init.py, where custom authorization handlers registered with resource-specific decorators fail to...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via a reference leak in the C extension's items view operations multidictitemsviewor2impl and multidictitemsviewsub1impl, which handle the operand | md.items and md.items - operand set...

Directory Traversal

Overview @angular/ssr is a the Angular server side rendering utilities. Affected versions of this package are vulnerable to Directory Traversal in the prerendered page lookup of CommonEngine in packages/angular/ssr/node/src/common-engine/common-engine.ts, which confirms containment with...

Command Injection

Overview @nx/docker is a The Nx Plugin for Docker to aid in containerizing projects. Affected versions of this package are vulnerable to Command Injection via the docker tag, docker push, and docker images calls in the release pipeline, where registry URL, repository name, version scheme,...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via validatepath in dulwich/index.py when processing tree entries whose leading path component is a DOS drive-letter prefix e.g., C:. On Windows, os.path.joinroot, b"C:..." discards the work-tree root and resolves to...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via unpackobject in dulwich/pack.py when parsing a pack file containing an OFSDELTA entry whose deltabaseoffset is zero. Such an entry references itself, causing Pack.resolveobject to loop forever, growing its delta stack...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the paths= branch of porcelain.checkout in dulwich, which wrote file content using a raw os.openfilepath, OWRONLY|OCREAT|OTRUNC call that follows existing symlinks at the target path. An attacker...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via applyindexfilter in dulwich/filterbranch.py, which called buildindexfromtree".", ... to materialize tree entries into the caller's working directory and left them there between commits. An attacker can craft a...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via verifyleadingdirs absent in affected versions in dulwich/stash.py during stash.pop. The old path-existence check used os.path.exists, which follows symlinks, so a stash entry whose parent path component is a symlink...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:seroval is a Stringify JS values Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via createTypedArrayNode, createBigIntTypedArrayNode, and createDataViewNode in base-primitives.ts, and the corresponding...

Allocation of Resources Without Limits or Throttling

Overview seroval is a Stringify JS values Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via createTypedArrayNode, createBigIntTypedArrayNode, and createDataViewNode in base-primitives.ts, and the corresponding deserialization paths in...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview org.webjars.npm:seroval is a Stringify JS values Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the deserializePromise and deserializePromiseFulfill functions in deserializer.ts, where a thenable object an object with a...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview seroval is a Stringify JS values Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the deserializePromise and deserializePromiseFulfill functions in deserializer.ts, where a thenable object an object with a then property...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uniqs helper and index-membership checks in src/parser.js when parsing flat selectors e.g. .a.a.a... containing a large number of class or ID tokens. The original implementation uses...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uniqs helper and index-membership checks in src/parser.js when parsing flat selectors e.g. .a.a.a... containing a large number of class or ID tokens. The original implementation uses...

Directory Traversal

Overview org.webjars.npm:nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which...

Directory Traversal

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which returned the...

Access Control Bypass

Overview org.webjars.npm:nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Access Control Bypass via insecure creation of Unix domain sockets for the Nx daemon and isolat...

Access Control Bypass

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Access Control Bypass via insecure creation of Unix domain sockets for the Nx daemon and isolated plugin worker...

Arbitrary Code Injection

Overview fsspec is a File-system specification Affected versions of this package are vulnerable to Arbitrary Code Injection in the reference filesystem process. An attacker can execute arbitrary code by tricking an application into loading a maliciously crafted reference document, such as a...