Lucene search
+L

36927 matches found

Snyk
Snyk
added 2026/06/22 9:19 a.m.2 views

Missing Authorization

Overview org.apache.nifi:nifi-runtime-manifest-core is an Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the...

7.5CVSS6AI score0.00393EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 9:19 a.m.3 views

Missing Authorization

Overview org.apache.nifi:nifi-framework-core is a system to process and distribute data. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to...

7.5CVSS6AI score0.00393EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 9:19 a.m.3 views

Missing Authorization

Overview org.apache.nifi:nifi-stateless-engine is a NiFi Extensions Bill of Materials Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to...

7.5CVSS6AI score0.00393EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 9:19 a.m.4 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to restricted components by submitting requests to replace Process Groups without...

7.5CVSS6AI score0.00393EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 9:19 a.m.3 views

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in CaptureChangeMySQL. An attacker can execute unauthorized SQL commands by crafting malicious table names. Note: This is only exploitable if CaptureChangeMySQL is enabled and used in the...

7.6CVSS6.1AI score0.00385EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 9:19 a.m.4 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to restricted components by submitting requests to replace Process Groups without...

7.5CVSS6AI score0.00393EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 9:19 a.m.3 views

Missing Authorization

Overview org.apache.nifi:nifi-framework-cluster is a clustering software for NiFi. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to...

7.5CVSS6AI score0.00393EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 9:19 a.m.5 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to restricted components by submitting requests to replace Process Groups without...

7.5CVSS6AI score0.00393EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 9:18 a.m.4 views

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the processing of HTTP request headers, specifically X-ProxyHost and X-Forwarded-Host. An attacker can manipulate the construction of qualified URLs for redirection or data references by supplying crafted valu...

6.3CVSS6AI score0.00268EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 6:30 a.m.7 views

Malicious Package

Overview node-path-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
Exploits0References2
Snyk
Snyk
added 2026/06/22 6:30 a.m.9 views

Malicious Package

Overview mddriver is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
Exploits0References2
Snyk
Snyk
added 2026/06/22 4:17 a.m.8 views

LDAP Injection

Overview Affected versions of this package are vulnerable to LDAP Injection via the SearchFirstActiveDirectoryRealm.findUserDn function. An attacker can manipulate the LDAP search filter by injecting metacharacters , , , , NUL into the username field, which may result in authentication confusion...

7.2CVSS5.9AI score0.00386EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 4:15 a.m.8 views

Use of Hard-coded Credentials

Overview com.linecorp.centraldogma:centraldogma-server is a service configuration repository based on Git, ZooKeeper and HTTP/2 centraldogma-server. Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the ZooKeeperReplicationConfig.secret when the replication.secr...

9.6CVSS6.2AI score0.00145EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 4:15 a.m.7 views

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication due to the SSH client not verifying remote host keys for git+ssh:// connections. An attacker can intercept and compromise mirrored repositories by performing man-in-the-middle attacks...

8.8CVSS6AI score0.00139EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/22 1:12 a.m.4 views

Arbitrary Code Injection

Overview langflow is an A Python package with a built-in web application Affected versions of this package are vulnerable to Arbitrary Code Injection in the Bundle URL Loader process. An attacker can execute arbitrary code by supplying crafted input to this component. Remediation There is no fixe...

7.8CVSS6.5AI score0.00188EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 9:0 p.m.10 views

Malicious Package

Overview apintergrationpost is a malicious package. This package conceals a Linux remote access trojan RAT called MYRA. The package's documentation claims it is designed for "authorized red team exercises and EDR validation." Regardless of the publisher's intent, it should be treated as malicious...

9.8CVSS6AI score
Exploits0References2
Snyk
Snyk
added 2026/06/21 7:15 p.m.4 views

Incorrect Calculation of Buffer Size

Overview Affected versions of this package are vulnerable to Incorrect Calculation of Buffer Size in the XMLNode::parseFile function. An attacker can cause memory corruption, potentially leading to information disclosure or application disruption, by supplying specially crafted XML input...

7.5CVSS6.5AI score0.00279EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 5:11 p.m.9 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the storeAtts function. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted input that triggers the...

7.5CVSS6.2AI score0.00102EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 5:11 p.m.5 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the addBinding function. An attacker can cause memory corruption or potentially execute arbitrary code by providing crafted input that triggers an integer overflow. Remediation A fix was pushed into th...

7.5CVSS6.2AI score0.00102EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 5:11 p.m.9 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the xmlwf process when the -d parameter is used to specify an output directory. An attacker can cause unintended behavior or potentially execute arbitrary code by providing a specially crafted output...

7.3CVSS6.2AI score0.00098EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 5:11 p.m.5 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the doProlog process, specifically involving storeEntityValue and the calculation of entity textLen. An attacker can cause memory corruption or potentially...

7.5CVSS6.2AI score0.00102EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 5:11 p.m.21 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the getAttributeId function. An attacker can cause memory corruption or execute arbitrary code by providing specially crafted input that triggers an integer overflow. Remediation A fix was pushed into...

7.5CVSS6.2AI score0.00102EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 5:11 p.m.9 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the resolveSystemId function. An attacker can cause unexpected behavior or potentially execute arbitrary code by providing specially crafted input that triggers an integer overflow during processing...

7.5CVSS6.2AI score0.0011EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 5:11 p.m.8 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the copyString function. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted input that triggers the...

7.5CVSS6.2AI score0.00102EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 5:9 p.m.7 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper validation in the XMLParseBuffer function. An attacker can cause unexpected behavior, including potential data corruption or application crashes, by providing specially crafted input that...

7.5CVSS5.9AI score0.00102EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 5:9 p.m.6 views

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free due to improper handler call depth tracking in the doCdataSection process. An attacker can cause memory corruption or potentially execute arbitrary code by triggering a use-after-free condition through crafted XML input...

5.9CVSS6.2AI score0.00105EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 5:9 p.m.10 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the endDoctypeDecl process when handling NOTATION declarations. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted XML input. Remediation A fix...

7.5CVSS6.2AI score0.0011EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 3:13 p.m.4 views

Deserialization of Untrusted Data

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the cProfile.runctx function in pickle file reduce methods. An attacker can execute arbitrary code by...

8.1CVSS6.2AI score0.00338EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 3:12 p.m.5 views

Deserialization of Untrusted Data

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the runcommand function of idlelib.pyshell.ModifiedInterpreter when handling pickle files in reduce method...

9.6CVSS6.2AI score0.00276EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 3:11 p.m.4 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized processing of package metadata and README content in the Bazaar marketplace. An attacker can execute arbitrary operating system commands by embedding malicious HTML or JavaScript payloads in the...

9.6CVSS5.8AI score0.00391EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 3:10 p.m.6 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized handling of package metadata and README content in the Bazaar marketplace. An attacker can execute arbitrary operating system commands by embedding malicious HTML or JavaScript in the displayName...

9.6CVSS5.8AI score0.00391EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/21 11:11 a.m.6 views

Insufficient Session Expiration

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Insufficient Session Expiration in the getredirectresponsefromopenid function of the SSO Authentication Flow process. An attacker can cause premature session termination by...

6.5CVSS6.6AI score0.00358EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 11:10 a.m.9 views

Incorrect Authorization

Overview litellm-enterprise is a Package for LiteLLM Enterprise features Affected versions of this package are vulnerable to Incorrect Authorization in the BannedKeywords enterprise and AzureContentSafety hooks of the Completions Interface. An attacker can gain unauthorized access to restricted...

6.5CVSS6.6AI score0.00226EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 11:10 a.m.8 views

Incorrect Authorization

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Incorrect Authorization in the BannedKeywords enterprise and AzureContentSafety hooks of the Completions Interface. An attacker can gain unauthorized access to restricted...

6.5CVSS6.6AI score0.00226EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 11:10 a.m.10 views

Server-side Request Forgery (SSRF)

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the loadopenapispecasync function of the MCP OpenAPI Spec Loader component when processing the specpath argument. An attacker can access...

6.5CVSS6.6AI score0.00262EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 11:10 a.m.8 views

Incorrect Privilege Assignment

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the /user/filter/ui endpoint. An attacker can gain unauthorized access to user information by sending crafted requests with insufficient...

5.3CVSS6.2AI score0.00288EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 10:10 a.m.7 views

Missing Authentication for Critical Function

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the /sso/debug/login and /sso/debug/callback endpoints in the SSO Debug Flow. An attacker can gain unauthorized access and...

7.5CVSS7.1AI score0.00508EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 5:6 a.m.11 views

Authentication Bypass Using an Alternate Path or Channel

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via exception handling in the MCP proxy authentication flow. An attacker can bypass authentication by supplying an...

9.8CVSS7.8AI score0.00612EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 5:6 a.m.12 views

Server-side Request Forgery (SSRF)

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /v1/mcp/test/connection endpoint. An attacker can perform server-side request forgery SSRF by supplying a crafted tokenurl and...

6.5CVSS6.8AI score0.00262EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 3:6 a.m.13 views

Incorrect Authorization

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Incorrect Authorization in the userapikeyauth.py file of the M2M JWT Handler. An attacker can gain unauthorized access to resources by exploiting insufficient authorization...

7.5CVSS6AI score0.00288EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 2:39 a.m.9 views

Insufficient Session Expiration

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Insufficient Session Expiration in the authenticateuser function. An attacker can gain unauthorized access or maintain access to sensitive information by exploiting session...

7.1CVSS6.6AI score0.00262EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/21 1:4 a.m.12 views

Missing Authorization

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Missing Authorization in the keymanagementendpoints.py file. An attacker can gain unauthorized access to administrative key management operations by sending crafted request...

8.8CVSS6.1AI score0.00337EPSS
Exploits1References2
Snyk
Snyk
added 2026/06/20 9:0 p.m.9 views

Malicious Package

Overview @withgoogle/stitch-sdk is a malicious package. Although this package attempts to impersonate Google's Stitch AI design tool, there is no connection between Google and this package. By squatting the @withgoogle npm scope, a malicious actor published @withgoogle/stitch-sdk in an attempt to...

9.8CVSS6AI score
Exploits0References2
Snyk
Snyk
added 2026/06/20 6:7 p.m.6 views

Arbitrary Code Injection

Overview prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest. Affected versions of this package are vulnerable to Arbitrary Cod...

9.9CVSS7.5AI score0.00874EPSS
Exploits3References2
Snyk
Snyk
added 2026/06/20 3:21 p.m.6 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the POST /resources/:resource/:id/:related endpoint. An attacker can gain unauthorized access to sensitive relationships and escalate privileges by sending crafted POST requests to manipulate associations,...

9.6CVSS5.9AI score0.00331EPSS
Exploits0References2
Snyk
Snyk
added 2026/06/19 10:10 p.m.13 views

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via insufficient validation of the Origin header and improper handling of request paths in the local HTTP server. An attacker can access and exfiltrate arbitrary local files by sending crafted requests from a...

8.7CVSS6.1AI score0.00181EPSS
Exploits0References3
Snyk
Snyk
added 2026/06/19 10:10 p.m.7 views

Symlink Attack

Overview pydantic-settings is a Settings management using Pydantic Affected versions of this package are vulnerable to Symlink Attack in the NestedSecretsSettingsSource process when secretsnestedsubdir is enabled and a symbolic link inside the configured secrets directory points outside of it. An...

5.3CVSS6AI score0.00138EPSS
Exploits0References3
Snyk
Snyk
added 2026/06/19 10:10 p.m.4 views

Server-side Request Forgery (SSRF)

Overview @merill/lokka is a Lokka is a Model Context Protocol MCP server for Microsoft Graph. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper validation of user-supplied input in the process constructing Azure Resource Manager request URLs. An...

8.7CVSS6AI score
Exploits0References2
Snyk
Snyk
added 2026/06/19 10:10 p.m.4 views

Improper Verification of Cryptographic Signature

Overview @jhb.software/payload-cloudinary-plugin is a Payload CMS storage adapter for Cloudinary Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the cloudinary-generate-signature endpoint, which forwards attacker-controlled parameters to th...

7.1CVSS6AI score
Exploits0References2
Snyk
Snyk
added 2026/06/19 10:10 p.m.12 views

Access of Resource Using Incompatible Type ('Type Confusion')

Overview langsmith is a Client library to connect to the LangSmith Observability and Evaluation Platform. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the file attachments handling. An attacker can access local files on the...

7.1CVSS6AI score0.00174EPSS
Exploits0References4
Total number of security vulnerabilities36927