Protection Mechanism Failure

Overview Magick.NET-Q8-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Protection Mechanism Failure

Overview Magick.NET-Q16-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Protection Mechanism Failure

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Protection Mechanism Failure

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Protection Mechanism Failure

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Protection Mechanism Failure

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the LoadPolicyCache process when policy.xml uses an alternate DOCTYPE. An attacker can bypass security policy enforcement by crafting a policy.xml file with a DOCTYPE not ending in '', causing the parser ...

Cross-site Scripting (XSS)

Overview org.webjars.npm:showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the makehtml.image and makehtml.link sub-parsers, when processing inline links or images whose angle-bracket destination URL contains a...

Cross-site Scripting (XSS)

Overview showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the makehtml.image and makehtml.link sub-parsers, when processing inline links or images whose angle-bracket destination URL contains a double-quote...

Incorrect Authorization

Overview langgraph-sdk is a SDK for interacting with LangGraph API Affected versions of this package are vulnerable to Incorrect Authorization via the ResourceOn.call method in langgraphsdk/auth/init.py, where custom authorization handlers registered with resource-specific decorators fail to...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via a reference leak in the C extension's items view operations multidictitemsviewor2impl and multidictitemsviewsub1impl, which handle the operand | md.items and md.items - operand set...

Directory Traversal

Overview @angular/ssr is a the Angular server side rendering utilities. Affected versions of this package are vulnerable to Directory Traversal in the prerendered page lookup of CommonEngine in packages/angular/ssr/node/src/common-engine/common-engine.ts, which confirms containment with...

Command Injection

Overview @nx/docker is a The Nx Plugin for Docker to aid in containerizing projects. Affected versions of this package are vulnerable to Command Injection via the docker tag, docker push, and docker images calls in the release pipeline, where registry URL, repository name, version scheme,...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via validatepath in dulwich/index.py when processing tree entries whose leading path component is a DOS drive-letter prefix e.g., C:. On Windows, os.path.joinroot, b"C:..." discards the work-tree root and resolves to...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via unpackobject in dulwich/pack.py when parsing a pack file containing an OFSDELTA entry whose deltabaseoffset is zero. Such an entry references itself, causing Pack.resolveobject to loop forever, growing its delta stack...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the paths= branch of porcelain.checkout in dulwich, which wrote file content using a raw os.openfilepath, OWRONLY|OCREAT|OTRUNC call that follows existing symlinks at the target path. An attacker...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via applyindexfilter in dulwich/filterbranch.py, which called buildindexfromtree".", ... to materialize tree entries into the caller's working directory and left them there between commits. An attacker can craft a...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via verifyleadingdirs absent in affected versions in dulwich/stash.py during stash.pop. The old path-existence check used os.path.exists, which follows symlinks, so a stash entry whose parent path component is a symlink...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:seroval is a Stringify JS values Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via createTypedArrayNode, createBigIntTypedArrayNode, and createDataViewNode in base-primitives.ts, and the corresponding...

Allocation of Resources Without Limits or Throttling

Overview seroval is a Stringify JS values Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via createTypedArrayNode, createBigIntTypedArrayNode, and createDataViewNode in base-primitives.ts, and the corresponding deserialization paths in...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview org.webjars.npm:seroval is a Stringify JS values Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the deserializePromise and deserializePromiseFulfill functions in deserializer.ts, where a thenable object an object with a...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview seroval is a Stringify JS values Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the deserializePromise and deserializePromiseFulfill functions in deserializer.ts, where a thenable object an object with a then property...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uniqs helper and index-membership checks in src/parser.js when parsing flat selectors e.g. .a.a.a... containing a large number of class or ID tokens. The original implementation uses...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uniqs helper and index-membership checks in src/parser.js when parsing flat selectors e.g. .a.a.a... containing a large number of class or ID tokens. The original implementation uses...

Directory Traversal

Overview org.webjars.npm:nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which...

Directory Traversal

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Directory Traversal via readNxMigrateConfig in packages/nx/src/utils/package-json.ts, which returned the...

Access Control Bypass

Overview org.webjars.npm:nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Access Control Bypass via insecure creation of Unix domain sockets for the Nx daemon and isolat...

Access Control Bypass

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Access Control Bypass via insecure creation of Unix domain sockets for the Nx daemon and isolated plugin worker...

Arbitrary Code Injection

Overview fsspec is a File-system specification Affected versions of this package are vulnerable to Arbitrary Code Injection in the reference filesystem process. An attacker can execute arbitrary code by tricking an application into loading a maliciously crafted reference document, such as a...

Origin Validation Error

Overview next is a react framework. Affected versions of this package are vulnerable to Origin Validation Error via the MCP middleware endpoint /next/mcp, where insufficient host validation allows a DNS rebinding attack. An attacker who controls a malicious DNS server can cause a victim's browser...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys to their source route in base-server.ts and related export/build pipeline files. When multiple routes share a cache...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via insufficient scoping of response cache keys in the server's cache key generation logic, where cache keys are not bound to their source route. An attacker can...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via cross-request deduplication in the use-cache-wrapper.ts cache function, where draft mode state is not accounted for when sharing cached fills across concurrent...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the listpagestag and includepages actions in the tags tool. An attacker can access the names and body-derived titles of pages that are protected by access control lists by embedding these actions with a chosen...

Prototype Pollution

Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Prototype Pollution via the map decoding process. An attacker can modify the prototype of...

Prototype Pollution

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Prototype Pollution via the map decoding process. An attacker can modify the prototype of all objects by...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the map decoding process. An attacker can modify the prototype of all objects by supplying a crafted map key during deserialization, potentially leading to arbitrary property injection or alteration of applicatio...

NULL Pointer Dereference

Overview apache/thrift is an Apache Thrift RPC system Affected versions of this package are vulnerable to NULL Pointer Dereference in the thriftprotocol process. An attacker can cause a crash or denial of service by sending specially crafted data that triggers a dereference of a missing...