Arbitrary Code Injection

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Arbitrary Code Injection via the automatic approval of classpath entries in...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the REST API when submitting a job configuration, due to improper validation of the coverage results ID. An attacker can execute arbitrary JavaScript in the context of other users by providing a specially...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure through the processing of build scan links detected in the build log. An attacker can obtain the Develocity access key configured in the global configuration by manipulating the build log to include a malicious URL,...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Jenkins UI when displaying CWE values from Dependency-Check reports. An attacker can execute arbitrary JavaScript code in the context of other users by injecting malicious content into the CWE values, whi...

Inefficient Algorithmic Complexity

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the thinkingbudgetstate.py file. An attacker can cause excessive resource consumption by submitting specially...

Cross-site Scripting (XSS)

Overview @platejs/core is a The core of Plate – a plugin system for slate Affected versions of this package are vulnerable to Cross-site Scripting XSS through the htmlStringToDOMNode and getEditorDOMFromHtmlString parsers in packages/core/src/lib/plugins/html/utils/htmlStringToDOMNode.ts and...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object...

Exposure of Resource to Wrong Sphere

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere through the evalhandler process...

Insufficient Session Expiration

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration in the session cleanup. An attacker can maintain unauthorized access by reusing a previously compromised...

Insufficient Session Expiration

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration in the Admin user-edit PATCH process. An attacker can maintain unauthorized access by reusing a previousl...

Authorization Bypass Through User-Controlled Key

Overview apache-airflow-providers-akeyless is a Provider package apache-airflow-providers-akeyless for Apache Airflow Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the Akeyless secrets backend. An attacker can access secrets belonging to...

Uncaught Exception

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Uncaught Exception via the reply.trailer function when handling HTTP/2 trailer responses. An attacker can cause the server process to crash and terminate all active requests by sending ...

Origin Validation Error

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Origin Validation Error in the idtoken validation. An attacker can gain unauthorized access by presenting a valid token issued for a...

Insufficient Session Expiration

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration due to the Core API accepting existing, unexpired tokens for accounts that have been deactivated by an...

Missing Authorization

Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Missing Authorization in the setWatches. An attacker can...

Incorrect Authorization

Overview apache-airflow-providers-keycloak is a Provider package apache-airflow-providers-keycloak for Apache Airflow Affected versions of this package are vulnerable to Incorrect Authorization in the unauthenticated token endpoint, which accepts a client-credentials grant for any confidential...

Improper Validation of Certificate with Host Mismatch

Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the...

Reliance on Cookies without Validation and Integrity Checking

Overview apache-airflow-providers-keycloak is a Provider package apache-airflow-providers-keycloak for Apache Airflow Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via getuserfromtoken in keycloakauthmanager.py, where Keycloak...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview apache-airflow-providers-apache-kafka is a Provider package apache-airflow-providers-apache-kafka for Apache Airflow Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' in the importstring function. An...

Improper Output Neutralization for Logs

Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs via the...

Improper Output Neutralization for Logs

Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in the audit logging...

Malicious Package

Overview tetomood is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @prime0/pcomatch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview discord-players is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tol8t is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview swnwall is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview otel-span-adapter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview strapi-plugin-pencc-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @prime0/alanced-match is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview webpackbootstrap5 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview plogme is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview discord-resolvers is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview webpackbootstrapscripts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview @zaka13/thing is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @prime0/inimatch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview engin1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview chai-as-agile is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tetotest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview strapi-plugin-ccsuc-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview cli-anything-ai-market is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview licloud is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview faiss-cpu-avx512 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the JWK.importkey method, whose keyops duplicate detection rescans the whole array for every element and enforces no size limit, making the check On^2 over untrusted parsed JWK data. An attacker can...

Denial of Service (DoS)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Denial of Service DoS through the MoRIIOWrapper.handlereleasemessage process. An attacker can cause excessive resource usage by manipulating the...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the inflater process. An attacker can exhaust system memory and disrupt service availability ...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the ci parameter in the GET request, which is passed to the unserialize function without restricting allowed classes. An attacker can execute arbitrary code or manipulate the database by supplying a...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.webjars.npm:adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the inflater process. An attacker can exhaust system memory and disrupt servi...

Malicious Package

Overview kartykp-prod-oidc-test-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview kartykp-token-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS in the readLoop process. An attacker can exhaust system memory by sending HTTP/2 frames with a declared payload size significantly larger than the configured maximum, causing the server or client to buffer excessiv...