Lucene search
+L

47469 matches found

Snyk
Snyk
added 2026/08/20 12:00 a.m.20 views

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the BrokerNotAliveException message when the RabbitMQ management aliveness check fails. An attacker can obtain sensitive credentials by accessing exception messages that are logged,...

6.5CVSS5.9AI score0.00324EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.14 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the getCacheName process. An attacker can overwrite arbitrary files on the filesystem by supplying a crafted URI fragment containing path traversal sequences when invoking the relevant resource-setting methods...

6.5CVSS6.3AI score0.0026EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.14 views

Directory Traversal

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Directory Traversal via the native environment repository process. An attacker can access sensitive...

7.5CVSS6.4AI score0.00324EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.15 views

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect in scenarios where a WebSocket handshake is redirected to a different origin and the HTTP client is explicitly configured to follow redirects. An attacker can obtain sensitive credentials by leveraging crafted redirect...

6.1CVSS5.9AI score0.00157EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.15 views

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the Flux.bufferTimeout process with fairBackpressure enabled when a race condition occurs between flushing buffered items and the arrival of new upstream items. An attacker can cause the stream to hang indefinitely and...

8.2CVSS5.9AI score0.00231EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.17 views

Cross-site Scripting (XSS)

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the...

7.1CVSS5.8AI score0.00181EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.18 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SimpleEvaluationContext file when the SpEL expression compiler is enabled through specific configuration settings. An attacker can cause unbounded class-loading growth and bypa...

9.8CVSS5.9AI score0.00374EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.14 views

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the ZipTransformer process. An attacker can overwrite or plant files in arbitrary directories by pre-creating a symbolic link at /tmp/ziptransformer before the application starts, causing extracted archive contents an...

6.8CVSS6AI score0.0035EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.11 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via filename headers when constructing the workDirectory path. An attacker can write a .zip archive to an arbitrary filesystem location outside the intended directory by supplying crafted input. Details A Directory...

5.4CVSS6.3AI score0.00255EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.26 views

Cross-site Request Forgery (CSRF)

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the GraphiQL process. An attacker can access confidential information by enticing a victim with an active sessio...

8.3CVSS5.9AI score0.00268EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.12 views

Missing Authentication for Critical Function

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the monitor endpoint, which does not validate incomi...

9.8CVSS5.9AI score0.00298EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.13 views

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the findByMetadata function. An attacker can access data from other conversations by injecting RediSearch syntax into user-controlled metadata fields. Remediation Upgrad...

5.3CVSS5.9AI score0.00219EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.21 views

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' through the composition lookup. An attacker can manipulate the base function by injecting malicious components during the lookup process,...

3.5CVSS5.9AI score0.00151EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.32 views

Exposure of Data Element to Wrong Session

Overview Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the fluxTransform when used with an asynchronous or reordering fluxFunction that emits raw payloads. An attacker can access another user's reply headers and cause reply mis-routing by sendin...

8.2CVSS5.9AI score0.00237EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.14 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the env actuator endpoint when no allow list is enforced for property keys. An attacker can modify arbitrary environment properties by sending crafted requests to the writable endpoint. Note: This is only...

7.6CVSS6AI score0.00332EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.14 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handling of HTTP/1.1 pipelined requests over a single connection. An attacker can cause excessive memory consumption by sending multiple pipelined requests, potentially leading...

8.7CVSS5.9AI score0.00238EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.16 views

Information Exposure

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

3.1CVSS5.9AI score0.00245EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.13 views

Deserialization of Untrusted Data

Overview org.springframework.amqp:spring-amqp is a package that provides support for using Spring and Java with AMQP 0.9.1, and in particular RabbitMQ. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the deserialization process. An attacker can cause...

7.5CVSS5.9AI score0.00248EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/20 12:00 a.m.18 views

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or...

8.2CVSS5.9AI score0.00259EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 10:51 p.m.11 views

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in client/llb/exec.go and executor/oci/speclinux.go. An attacker can disable Seccomp and AppArmor protections for a build container by supplying a crafted build request with an invalid...

6.3CVSS5.8AI score0.00357EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 10:51 p.m.11 views

Improper Validation of Specified Type of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in client/llb/exec.go and executor/oci/speclinux.go. An attacker can disable Seccomp and AppArmor protections for a build container by supplying a crafted build request with an invalid...

6.3CVSS5.8AI score0.00357EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 10:51 p.m.10 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded group parsing in the user and group file handling code in executor/oci/user.go and solver/llbsolver/ops/userlinux.go. An attacker can exhaust memory and trigger an OO...

5.5CVSS5.5AI score0.00404EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 10:51 p.m.10 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded group parsing in the user and group file handling code in executor/oci/user.go and solver/llbsolver/ops/userlinux.go. An attacker can exhaust memory and trigger an OO...

5.5CVSS5.5AI score0.00404EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 10:51 p.m.16 views

Infinite loop

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Infinite loop via the striphtml filter in src/filters/html.ts, which enters an infinite loop when processing certain input strings. A...

8.7CVSS5.6AI score0.00393EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 10:50 p.m.15 views

Improper Check for Unusual or Exceptional Conditions

Overview io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which...

9.1CVSS5.6AI score0.00282EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 9:08 p.m.5 views

Path Equivalence

Overview Affected versions of this package are vulnerable to Path Equivalence in its .terraformignore pattern matching, which compares filenames against ignore patterns without normalizing both to a common Unicode form. An attacker with write access to the working directory can cause sensitive...

5.7CVSS5.7AI score0.00103EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 9:00 p.m.138 views

Malicious Package

Overview typecript-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 8:48 p.m.12 views

Regular Expression Denial of Service (ReDoS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the regexReplace process. An attacker can exhaust server resources and cause denial of service b...

6CVSS5.9AI score0.00387EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 8:48 p.m.12 views

Improper Authentication

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Authentication in the login.regenerate2FASecret process. An attacker can gain unauthorized access by submitting a correct password fo...

9.1CVSS5.9AI score0.00386EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 7:32 p.m.11 views

Improper Handling of Case Sensitivity

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the .htaccess process on case-insensitive filesystems due to the lack of case-insensitive matching fo...

8.2CVSS6AI score0.005EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 6:45 p.m.11 views

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the dynamicData function. An attacker can execute arbitrary code by supplying a crafted callback and arguments,...

8.8CVSS6.2AI score0.00435EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 4:50 p.m.10 views

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure due to the storage of password reset tokens in a publicly accessible tracking file when user tracking is enabled. An attacker can...

8.8CVSS7.3AI score0.00341EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:50 p.m.11 views

Information Exposure

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure due to the storage of password reset tokens in a publicly accessible tracking file when user tracking is enabled. An attacker can...

8.8CVSS7.3AI score0.00341EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.12 views

Insufficient Logging

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insufficient Logging in the AuthLdap::create function. An attacker can gain unauthorized access to a previously blocked account by authenticating via...

8.8CVSS7.2AI score0.00298EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.12 views

External Control of File Name or Path

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to External Control of File Name or Path in the PDF export process. An attacker can access sensitive local files by embedding an tag with a src attribute...

7.1CVSS5.9AI score0.00366EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.12 views

External Control of File Name or Path

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to External Control of File Name or Path in the PDF export process. An attacker can access sensitive local files by embedding an tag with a src attribute...

7.1CVSS5.9AI score0.00366EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.12 views

Insufficient Logging

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insufficient Logging in the AuthLdap::create function. An attacker can gain unauthorized access to a previously blocked account by authenticating via...

8.8CVSS7.2AI score0.00298EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.12 views

Missing Authorization

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the admin API endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration. An attacker can access sensitive...

5.3CVSS5.9AI score0.00252EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.12 views

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the admin API endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration. An attacker can access sensitive...

5.3CVSS5.9AI score0.00252EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.10 views

Information Exposure

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the pdf.php endpoint. An attacker can access sensitive metadata, including titles, solution IDs, author names, and last-update...

6.9CVSS5.9AI score0.00261EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.12 views

Information Exposure

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the pdf.php endpoint. An attacker can access sensitive metadata, including titles, solution IDs, author names, and last-update...

6.9CVSS5.9AI score0.00261EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.13 views

Arbitrary Argument Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Arbitrary Argument Injection via the escapeLikeWildcards process. An attacker can cause excessive resource consumption and degrade service availability ...

6.9CVSS5.9AI score0.00308EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.15 views

Arbitrary Argument Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Arbitrary Argument Injection via the escapeLikeWildcards process. An attacker can cause excessive resource consumption and degrade service availability ...

6.9CVSS5.9AI score0.00308EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.13 views

Insecure Temporary File

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insecure Temporary File through the process that writes backup ZIP archives to a web-accessible location. An attacker can access sensitive files,...

6CVSS6AI score0.00334EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.12 views

Insecure Temporary File

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insecure Temporary File through the process that writes backup ZIP archives to a web-accessible location. An attacker can access sensitive files,...

6CVSS6AI score0.00334EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.8 views

Missing Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization through the register API endpoint. An attacker can create unauthorized user accounts by sending crafted requests to the affected A...

5.3CVSS5.9AI score0.00241EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.10 views

Missing Authorization

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization through the register API endpoint. An attacker can create unauthorized user accounts by sending crafted requests to the affected A...

5.3CVSS5.9AI score0.00241EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.14 views

Missing Critical Step in Authentication

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the remember-me process. An attacker can gain full authenticated access without completing second-factor...

8.6CVSS7.2AI score0.00255EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.8 views

Missing Critical Step in Authentication

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the remember-me process. An attacker can gain full authenticated access without completing second-factor...

8.6CVSS7.2AI score0.00255EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/19 4:49 p.m.15 views

Brute Force

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Brute Force via the two-factor authentication process. An attacker can bypass the attempt limit by repeatedly re-authenticating with a valid password to...

9.1CVSS7.2AI score0.00332EPSS
SaveExploits1References2
Total number of security vulnerabilities47469