Supported Tests by SmartScanner

365 tests found

Get Started

Test all vulnerabilities with our free version

Learn More

In-depth articles on vulnerability remediation

Vulnerability Name	Severity	CWE
Cross-Site Scripting in dojo - dojo Versions of dojo prior to 1.2.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize HTML code in user-controlled input, allowing attackers to...	Medium	CWE-79
Read the Docs vulnerable to Cross-Site Scripting (XSS) This vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that...	Medium	CWE-79
Incorrect default cookie name and recommendation The default cookie name (and documentation recommendation) was prefixed with Host__ instead of __Host-. The point of this prefix is for additional security, to ensure...	Low
Cross-Site Scripting in simditor Versions of simditor prior to 2.3.22 are vulnerable to Cross-Site Scripting. The package does not sanitize user input that is rendered with innerHTML, allowing attackers...	Medium	CWE-79
Cross-Site Scripting in bootbox All version of bootbox are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject...	Medium	CWE-79
Reflected Cross-Site Scripting in jquery.terminal Versions of jquery.terminal prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options anyLinks or invokeMethods set to...	Medium	CWE-79
Cross-Site Scripting in react-svg Versions of react-svg before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run...	High	CWE-79
Memory Exposure in tunnel-agent Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.	Medium	CWE-200
Cross-Site Scripting in shave Versions of shave prior to 2.5.3 are vulnerable to Cross-Site Scripting. The shave package overwrites HTML elements and in doing so fails to properly encode...	Medium	CWE-79
Cross-Site Scripting in bracket-template All versions of bracket-template are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used...	High	CWE-79
Prototype Pollution in deap Versions of deap before 1.0.1 are vulnerable to prototype pollution.	High	CWE-400
Denial of Service in canvas Versions of canvas prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.	Medium
Regular Expression Denial of Service A flaw was found in nodejs-marked versions from 0.5.0 to before 0.6.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service...	Medium
Path Traversal in localhost-now - localhost-now All versions of localhost-now are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2	High	CWE-22
Regular Expression Denial of Service - nwmatcher A Regular Expression vulnerability was found in nwmatcher before 1.4.4. The fix replacing multiple repeated instances of the “\s*” pattern.	Medium	CWE-400
Cross-Site Scripting in ids-enterprise - ids-enterprise Versions of ids-enterprise prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The modal component fails to sanitize input to the title attribute, which may...	High	CWE-79
Cross-Site Scripting in ids-enterprise Versions of ids-enterprise prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The soho-dropdown component does not properly encode its output and may allow attackers...	High	CWE-79
Remote code execution in Handlebars.js Handlebars.js before 4.1.0 has Remote Code Execution (RCE)	Medium
Sandbox Bypass Leading to Arbitrary Code Execution in constantinople Versions of constantinople prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.	High
HTML tag injection Serve Handler, before 5.0.3, has a XSS via HTML tag injection in directory lisiting page.	Medium
Insecure Default Configuration in tesseract.js Versions of tesseract.js prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through crossorigin.me which clearly states is not suitable for...	Medium	CWE-829
Prototype Pollution in lutils-merge All versions of lutils-merge are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object’s prototype, allowing attackers to...	Medium	CWE-400
Prototype Pollution in upmerge All versions of upmerge are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object’s prototype, allowing attackers to...	Medium	CWE-400
Failure to sanitize quotes which can lead to sql injection in squel All versions of squel are vulnerable to sql injection.	High	CWE-89
Regular Expression Denial of Service in underscore.string Versions of underscore.string prior to 3.3.5 are vulnerable to Regular Expression Denial of Service (ReDoS).	Medium	CWE-400
Cross-Site Scripting in marked Versions 0.3.7 and earlier of marked unescape only lowercase while owsers support both lowercase and uppercase x in hexadecimal form of HTML character entity	Medium
Cross-Site Scripting (XSS) in cloudcmd Versions of cloudcmd before 9.1.6 are vulnerable to cross-site scripting (XSS) when listing files in a directory. The attacker must control the name of a...	High	CWE-79
Denial of Service in url-relative All versions of url-relative are vulnerable to Denial of Service. If the values to and from are equal, the function hangs and never returns. This...	Medium	CWE-400
Content injection in marked Versions 0.3.7 and earlier of marked When mangling is disabled via option mangle don’t escape target href. This allow attacker to inject arbitrary html-event into...	Medium
Command Injection in dot All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template...	Medium	CWE-77
Reverse Tabnapping in swagger-ui Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the...	Medium	CWE-1022
Cross-Site Scripting in ids-enterprise - ids-enterprise - GHSA-crfx-5phg-hmw9 Versions of ids-enterprise prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the soho-autocomplete component are not properly encoded and may allow...	High	CWE-79
Cross-Site Scripting in @nuxt/devalue Versions of @nuxt/devalue prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys....	Medium	CWE-79
Cross-Site Scripting via JSONP JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.	Medium	CWE-79
Denial of Service in mem Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after...	Medium	CWE-400
Cross-Site Scripting in cyberchef Versions of cyberchef prior to 8.31.3 are vulnerable to Cross-Site Scripting. In Text Encoding Brute Force the table rows are created by concatenating the value...	Medium	CWE-79
Cross-Site Scripting in dojo - dojo - GHSA-536q-8gxx-m782 Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the _testCommon.js and runner.html...	Medium	CWE-79
Message Signature Bypass in openpgp Versions of openpgp prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type text....	High	CWE-347
Prototype Pollution in deeply Versions of deeply prior to 1.0.1 are vulnerable to Prototype Pollution. The package fails to validate which Object properties it updates. This allows attackers to...	High	CWE-400
Cross-Site Scripting in iobroker.web Versions of iobroker.web prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server...	Medium	CWE-79
Remote Code Execution in Angular Expressions The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input.	High	CWE-74
Validation bypass is possible in Json Pattern Validator In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated...	Medium	CWE-287
Cross-Site Scripting in selectize-plugin-a11y Versions of selectize-plugin-a11y prior to 1.1.0 are vulnerable to Cross-Site Scripting. The accessibility.liveRegion.speak function does not sanitize the msg variable before rendering it as HTML....	Medium	CWE-79
Denial of Service in rgb2hex All versions of rgb2hex are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value....	Medium	CWE-400
Improper Key Verification in openpgp Versions of openpgp prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed...	High	CWE-347
Cross-Site Scripting in vant Versions of vant prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the Picker component column is not sanitized, which may allow...	High	CWE-79
Incorrect Account Used for Signing - eth-ledger-bridge-keyring Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the...	High	CWE-287
Incorrect Account Used for Signing Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the...	High	CWE-287
OS Command Injection in devcert-sanscache devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable commonName controlled by user...	High	CWE-78
Regular Expression Denial of Service in Acorn Affected versions of acorn are vulnerable to Regular Expression Denial of Service.A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite...	High	CWE-400
Sandbox bypass in constantinople constantinople before 3.1.1 affected by a sandbox bypass.	Medium
Command Injection in hot-formula-parser Versions of hot-formula-parser prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the parse function and concatenates it...	High	CWE-94
False-negative validation results in MINT transactions with invalid baton - slpjs Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result...	High	CWE-697
False-negative validation results in MINT transactions with invalid baton Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result...	High	CWE-697
discord-html not escaping HTML code blocks when lacking a language identifier Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.	High
Downloads Resources over HTTP in rs-brightcove Affected versions of rs-brightcove insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
Prototype Pollution in Dojox The Dojox jQuery wrapper jqMix mixin method is vulnerable to Prototype Pollution.	Low	CWE-94
XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode Potential XSS vulnerability for users of dojox/xmpp and dojox/dtl.	Medium	CWE-79
Cross-Site Scripting in seeftl All versions of seeftl are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim’s...	High	CWE-79
XSS in TinyMCE A cross-site scripting (XSS) vulnerability was discovered in: the core parser and media plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted...	Medium	CWE-79
Holder can generate proof of ownership for credentials it does not control in vp-toolkit The verifyVerifiablePresentation() method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the credentialSubject.id DID matches the signer of the...	High
Holder can (re)create authentic credentials after receiving a credential in vp-toolkit The verifyVerifiableCredential() method check the cryptographic integrity of the Verifiable Credential, but it does not check if the credential.issuer DID matches the signer of the...	High
Cross-Site Scripting in fileview All versions of fileview are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim’s...	High	CWE-79
Cross-Site Scripting in sanitize-html - sanitize-html - GHSA-3j7m-hmh3-9jmp Affected versions of sanitize-html do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript.	Medium	CWE-79
Information disclosure through error object in auth0.js Between versions 8.0.0 and 9.13.1(inclusive), in the case of an (authentication) error, the error object returned by the library contains the original request of the...	High	CWE-522
Introspection in schema validation in Apollo Server We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The Resolution section contains details on patched...	Medium
Validation Bypass in slp-validate Versions of slp-validate prior to 1.0.1 are vulnerable to a validation bypass. Bitcoin scripts may cause the validation result from slp-validate to differ from the...	High	CWE-20
Resources Downloaded over Insecure Protocol in igniteui Affected versions of igniteui download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view...	Low	CWE-311
Sandbox Breakout in realms-shim Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the...	High
Cross-Site Scripting in editor.md All versions of editor.md are vulnerable to Cross-Site Scripting. User input is insufficiently sanitized, allowing attackers to inject malicious code in payloads containing base64-encoded content....	Medium	CWE-79
Cross Site Scripting (XSS) in plotly.js Affected versions of plotly.js are vulnerable to cross-site scripting if an attacker can convince a user to visit a malicious plot on a site using...	Medium	CWE-79
Missing Origin Validation in parcel-bundler - parcel-bundler Versions of parcel-bundler before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer’s source code...	High	CWE-200
Denial of Service in nes Affected versions of nes are vulnerable to denial of service when given an invalid cookie header, and websocket authentication is set to cookie. Submitting an...	High	CWE-400
Critical severity vulnerability that affects slpjs No description available.	High	CWE-20
Downloads Resources over HTTP in jser-stat Affected versions of jser-stat insecurely downloads resources over HTTP.	Medium	CWE-311
Moderate severity vulnerability that affects validator - validator - GHSA-552w-rqg8-gxxm The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.	Medium	CWE-79
Regular Expression Denial of Service in ssri Version of ssri prior to 5.2.2 are vulnerable to regular expression denial of service (ReDoS) when using strict mode.	Medium	CWE-400
Sandbox Breakout in realms-shim - realms-shim Versions of realms-shim prior to 1.2.0 are vulnerable to a Sandbox Breakout. Reflect.construct can be used on the sandboxed Function constructor to reach the prototypes...	High
Default Express middleware security check is ignored in production No description available.	High
XSS Filter Bypass via Encoded URL in validator Versions of validator prior to 2.0.0 contained an xss filter method that is affected by several filter bypasses. This may result in a cross-site scripting...	Medium	CWE-79
Cross-Site Scripting in nunjucks Affected versions of nunjucks do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability....	Medium	CWE-79
Cross-Site Scripting in handlebars Versions of handlebars prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted.	Medium	CWE-79
Arbitrary Code Injection in pouchdb Affected versions of pouchdb do not properly sandbox the code execution engine which executes the map/reduce functions for temporary views and design documents. Under certain...	High	CWE-94
High severity vulnerability that affects gun The static file server module included with GUN had a serious vulnerability:	High	CWE-22
VBScript Content Injection in marked Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.	Medium	CWE-79
Moderate severity vulnerability that affects marked This advisory has been withdrawn, per NVD: “This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.”	Medium
Prototype Pollution in async merge-object The utilities function in all versions of the merge-object node module can be tricked into modifying the prototype of Object when the attacker can control...	High	CWE-20
Cross-Site Scripting in serialize-javascript Versions of serialize-javascript prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect...	Medium	CWE-79
Low severity vulnerability that affects eye.js No description available.	Low
Downloads Resources over HTTP in strider-sauce Affected versions of strider-sauce insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
Prototype Pollution in merge-options All versions of merge-options are vulnerable to Prototype Pollution	High	CWE-20
Downloads Resources over HTTP in openframe-glslviewer Affected versions of openframe-glslviewer insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
Downloads Resources over HTTP in product-monitor Affected versions of product-monitor insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
Multiple XSS Filter Bypasses in validator Versions of validator prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the blacklist-based filter.	Medium	CWE-79
ReDoS via long UserAgent header in ua-parser Affected versions of ua-parser are vulnerable to regular expression denial of service when given a specially crafted User-Agent header.	High	CWE-400
Cross-Site Scripting in mustache Versions of mustache prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted.	High	CWE-79
Regular Expression Denial of Service in parsejson Affected versions of parsejson are vulnerable to a regular expression denial of service when parsing untrusted user input.	High	CWE-400
Path Traversal in socket.io-file All versions of socket.io-file are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths....	High	CWE-22
Regular expression denial of service in url-regex all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial...	High	CWE-400
ECDSA signature vulnerability of Minerva timing attack in jsrsasign ECDSA side-channel attack named Minerava have been found and it was found that it affects to jsrsasign.	Medium	CWE-362
Stored XSS in TimelineJS3 TimelineJS renders some user data as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This...	High	CWE-79
Storing Password in Local Storage The setPassword method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user’s password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe...	Medium	CWE-256
Unrestricted Upload of File with Dangerous Type in blueimp-file-upload Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0	High	CWE-434
Cross-Site Scripting in @progress/kendo-angular-editor Kendo UI for Angular Editor Component (npm package @progress/kendo-angular-editor) before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts...	High	CWE-79
False-positive validity for NFT1 genesis transactions in SLPJS In the npm package named “slpjs”, versions prior to 0.27.4 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type.	High	CWE-697
Cross-Site Scripting in bootstrap-tagsinput All versions of bootstrap-tagsinput are vulnerable to cross-site scripting when user input is passed into the itemTitle parameter unmodified, as the package fails to properly...	High	CWE-79
Cross-Site Scripting in jqtree Affected versions of jqtree are vulnerable to cross-site scripting in the drag and drop functionality for modifying tree data.	High	CWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-p239-93f7-h6xf Affected versions of swagger-ui contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document.	High	CWE-79
Cross-Site Scripting (XSS) in pivottable Affected versions of pivottable are vulnerable to cross-site scripting, due to a new mechanism used to render JSON elements.	High	CWE-79
DOM-based XSS in auth0-lock Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection.	Low	CWE-79
Multiple Content Injection Vulnerabilities in marked Versions 0.3.0 and earlier of marked are affected by two cross-site scripting vulnerabilities, even when sanitize: true is set.	Medium	CWE-79
Authentication Bypass in console-io Affected versions of the console-io package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As console-io allows...	High	CWE-287
Insecure randomness in socket.io Affected versions of socket.io depend on Math.random() to create socket IDs, and therefore the IDs are predictable. With enough information on prior IDs, an attacker...	High	CWE-330
Moderate severity vulnerability that affects validator The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.	Medium	CWE-79
Sensitive Data Exposure in msrcrypto Versions of msrcrypto prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package’s Elliptic Curve Cryptography (ECC) implementation may leak information about a server’s...	High	CWE-682
Downloads Resources over HTTP in js-given Affected versions of js-given insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
Moderate severity vulnerability that affects validator - validator The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.	Medium	CWE-79
Command Injection in wxchangba All versions of wxchangba are vulnerable to Command Injection. The package does not validate user input on the reqPostMaterial function, passing contents of the file...	Medium	CWE-77
Cross-Site Scripting in @berslucas/liljs Versions of @berslucas/liljs prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe innerHTML function without sanitizing input, which may allow...	Medium	CWE-79
Malicious Package in rpc-websocket Versions of rpc-websocket >= 0.7.6 contained malicious code. The package opens a backdoor to a remote server and executes arbitrary commands, effectively acting as a...	High	CWE-506
Arbitrary Code Execution in mathjs - mathjs math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary...	High	CWE-94
Auth0-js bypasses CSRF checks The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it’s...	High	CWE-352
False-positive validity for NFT1 genesis transactions In the npm package named “slp-validate”, versions prior to 1.2.2 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type.	High	CWE-697
XSS via JQLite DOM manipulation functions in AngularJS XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new...	Medium	CWE-79
Command Injection in ungit - ungit Versions of ungit prior to 0.9.0 are affected by a command injection vulnerability in the url parameter.	High	CWE-77
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-7f59-x49p-v8mq Affected versions of swagger-ui are vulnerable to cross-site scripting in both the consumes and produces parameters of the swagger JSON document for a given API....	High	CWE-79
Cross-Site Scripting in mrk.js Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.	High	CWE-79
Cross-Site Scripting in react-marked-markdown All versions of react-marked-markdown are vulnerable to cross-site scripting (XSS) via href attributes. This is exploitable if user is provided to react-marked-markdown	High	CWE-79
Denial of Service in ethereumjs-vm ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a “code: Buffer.from(my_code, ‘hex’)” attribute.	High	CWE-119
Malicious Package in angular-material-sidenav-rnd Version 0.1.1 of angular-material-sidenav-rnd contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High	CWE-506
Malicious Package in cordova-plugin-china-picker Version 1.0.910 of cordova-plugin-china-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High	CWE-506
Arbitrary JavaScript Execution in typed-function Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute...	High	CWE-94
Cross-Site Scripting in semantic-ui-search All versions of semantic-ui-search are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead...	High	CWE-79
HTML Injection in preact Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package...	Medium	CWE-74
Cross-Site Scripting in cmmn-js-properties-panel Versions of cmmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow...	High	CWE-79
Prototype Pollution in lodash.defaultsdeep - lodash.defaultsdeep Versions of lodash.defaultsdeep before 4.6.1 are vulnerable to prototype pollution. The function mergeWith may allow a malicious user to modify the prototype of Object via...	High	CWE-1321
Command Injection in marsdb All versions of marsdb are vulnerable to Command Injection. In the DocumentMatcher class, selectors on $where clauses are passed to a Function constructor unsanitized. This...	High	CWE-77
Cross-Site Scripting in fomantic-ui Versions of fomantic-ui are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of...	High	CWE-79
Cross-Site Scripting in google-closure-library Versions of google-closure-library prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The safedomtreeprocessor.processToString() function improperly processed empty elements, which could allow attackers to execute arbitrary...	Medium	CWE-79
Cross-Site Scripting in hexo-admin All versions of hexo-admin are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a...	High	CWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-388g-jwpg-x6j4 Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This...	Medium	CWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-vp93-gcx5-4w52 Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript...	Medium	CWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-w992-2gmj-9xxj Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the swagger.apiInfo.description value without proper sanitization, which...	Medium	CWE-79
DOM-based XSS in gmail-js Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parse_response, helper.get.visible_emails_post, and helper.get.email_data_post functions, which pass user input directly into the Function constructor....	High	CWE-79
Incorrect Calculation in bigint-money Versions of bigint-money prior to 0.6.2 are vulnerable to an Incorrect Calculation. The package incorrectly rounded certain numbers, which could have drastic consequences due to...	Low	CWE-682
Malicious Package in bmap Version 1.0.3 of bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High	CWE-506
Regular Expression Denial of Service in ansi2html The ansi2html package is affected by a regular expression denial of service vulnerability when certain types of user input is passed in.	High	CWE-400
Regular Expression Denial of Service in validator Versions of validator prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the isURL method.	High	CWE-400
Reverse Tabnabbing in quill Versions of quill prior to 1.3.7 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the...	Medium	CWE-1022
User Impersonation in converse.js Versions of converse.js prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of XEP-0280:...	Medium	CWE-346
XSS in client rendered block templates in rendr Affected versions of rendr are vulnerable to cross-site scripting when client side rendering is done inside a _block.	High	CWE-79
Denial of Service in handlebars Affected versions of handlebars are vulnerable to Denial of Service. The package’s parser may be forced into an endless loop while processing specially-crafted templates. This...	Medium	CWE-400
Prototype Pollution in sahmat All versions of sahmat are vulnerable to prototype pollution. The package does not restrict the modification of an Object’s prototype, which may allow an attacker...	High	CWE-1321
Cross-Site Scripting in atlasboard-atlassian-package All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize user input that is rendered as...	High	CWE-79
Cross-Site Scripting in bootstrap-select - bootstrap-select Versions of bootstrap-select prior to 1.13.6 are vulnerable to Cross-Site Scripting (XSS). The package does not escape title values on <option> tags. This may allow...	High	CWE-79
HTML Injection in marky-markdown - marky-markdown All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may...	High	CWE-79
Improper Authorization in react-oauth-flow All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth...	High	CWE-285
Improper Authorization in @sap-cloud-sdk/core Affected versions of @sap-cloud-sdk/core do not properly validate JWTs. The verifyJwt() function does not properly validate the URL from where the public verification key for...	High	CWE-285
Cross-Site Scripting in mermaid - mermaid Versions of mermaid prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as A["<img src=invalid onerror=alert('XSS')></img>"] is provided to the application, it...	High	CWE-79
Denial of Service in serialize-to-js Versions of serialize-to-js prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead...	High
Missing Origin Validation in browserify-hmr Versions of browserify-hmr prior to 0.4.0 are missing origin validation on the websocket server.	High	CWE-200
Prototype Pollution in smart-extend All versions of smart-extend are vulnerable to Prototype Pollution. The deep() function allows attackers to modify the prototype of Object causing the addition or modification...	Medium	CWE-1321
Command Injection in soletta-dev-app All versions of soletta-dev-app are vulnerable to Command Injection. The package does not validate user input on the /api/service/status API endpoint, passing contents of the...	High	CWE-77
Malicious Package in react-datepicker-plus Versions 2.4.3 and 2.4.2 of react-datepicker-plus contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms...	High	CWE-506
Malicious Package in vue-backbone Version 0.1.2 of vue-backbone contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High	CWE-506
Cross-Site Scripting in diagram-js-direct-editing Versions of diagram-js-direct-editing prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary...	Medium	CWE-79
Cross-Site Scripting in graylog-web-interface All versions of graylog-web-interface are vulnerable to Cross-Site Scripting (XSS). The package fails to escape output on the TypeAhead and QueryInput components, which may allow...	High	CWE-79
Cross-Site Scripting in @ionic/core Versions of @ionic/core prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe innerHTML function without sanitizing...	High	CWE-79
Cross-Site Scripting in jquery.json-viewer - jquery.json-viewer Versions of jquery.json-viewer prior to 1.3.0 are vulnerable to Cross-Site Scripting (XSS). The package insufficiently sanitizes user input when creating links, and concatenates the user...	High	CWE-79
Path Traversal in zero Versions of zero prior to 1.0.6 are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using...	High	CWE-22
Cross-Site Scripting in dmn-js-properties-panel Versions of dmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow...	High	CWE-79
Cross-Site Scripting in Prism - prismjs The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer.	High	CWE-79
Prototype Pollution in lodash.merge Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function ‘merge’ may allow a malicious user to modify the prototype of Object via...	High	CWE-1321
Cross-Site Scripting in snekserve All versions of snekserve are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim’s...	High	CWE-79
CSRF Vulnerability in jquery-ujs Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers...	Medium	CWE-352
Cross-Site Scripting in yui Affected versions of yui are vulnerable to cross-site scripting in the uploader.swf and io.swf utilities, via script injection in the url.	Medium	CWE-79
Arbitrary File Write in iobroker.admin Versions of iobroker.admin prior to 3.6.12 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended folder in...	High	CWE-22
Prototype Pollution in get-setter All versions of get-setter are vulnerable to prototype pollution. The function set does not restrict the modification of an Object’s prototype, which may allow an...	High	CWE-1321
Prototype Pollution in getsetdeep All versions of getsetdeep are vulnerable to prototype pollution. The setDeep() function does not restrict the modification of an Object’s prototype, which may allow an...	High	CWE-1321
Prototype Pollution in handlebars - handlebars - GHSA-g9r4-xpmj-mj65 Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype...	High	CWE-1321
Malicious Package in awesome_react_utility Version 1.0.2 of awesome_react_utility contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High	CWE-506
Malicious Package in codify Version 0.3.1 of codify contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High	CWE-506
Malicious Package in json-serializer - json-serializer Version 2.0.10 of json-serializer contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High	CWE-506
Command Injection in ascii-art Versions of ascii-art before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the ascii-art preview...	Low	CWE-77
Cross-Site Scripting in buefy Versions of buefy prior to 0.7.2 are vulnerable to Cross-Site Scripting, allowing attackers to manipulate the DOM and execute remote code. The autocomplete list renders...	High	CWE-79
Cross-Site Scripting in markdown-it-katex All versions of markdown-it-katex are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary...	High	CWE-79
Cross-Site Scripting in md-data-table All versions of md-data-table are vulnerable to cross-site scripting (XSS). This vulnerability is exploitable if an attacker has control over data that is rendered by...	High	CWE-79
HTML Injection in marky-markdown All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but...	Medium	CWE-79
Insecure Cryptography Algorithm in parsel All versions of parsel use an insecure cryptography algorithm. The package uses aes-256-cbc without integrity checks, which renders the ciphertext vulnerable to bit-flipping attacks.	High	CWE-327
Insufficient Entropy in parsel All versions of parsel use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key...	High	CWE-331
Cross-Site Scripting in htmr Versions of htmr prior to 0.8.7 are vulnerable to Cross-Site Scripting (XSS). The package uses innerHTML to unescape HTML entities. This may lead to DOM-based...	High	CWE-79
Cross-Site Scripting in wangeditor All versions of wangeditor are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and...	High	CWE-79
Cross-Site Request Forgery (CSRF) in Auth0 CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.	High	CWE-352
Malicious Package in motiv.scss Version 0.4.20 of motiv.scss contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High	CWE-506
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-22q9-hqm5-mhmc Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to encode output in GET requests.	Medium	CWE-79
Malicious Package in zemen Version 0.0.5 of zemen contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High	CWE-506
Path Traversal in ponse Versions of ponse prior to 2.0.2 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of...	High	CWE-22
Prototype Pollution in lodash.defaultsdeep Versions of lodash.defaultsdeep before 4.6.1 are vulnerable to Prototype Pollution. The function ‘defaultsDeep’ may allow a malicious user to modify the prototype of Object via...	High	CWE-1321
Prototype Pollution in mergify All versions of mergify are vulnerable to Prototype Pollution. The mergify() function allows attackers to modify the prototype of Object causing the addition or modification...	Medium	CWE-1321
Prototype Pollution in mithril Affected versions of mithrilare vulnerable to prototype pollution. The function parseQueryString may allow a malicious user to modify the prototype of Object, causing the addition...	High	CWE-1321
Unauthorized File Access in atompm Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads,...	High	CWE-200
Configuration Override in helmet-csp Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application’s Content Security Policy (CSP). The package’s browser sniffing for Firefox...	Medium
Cross-Site Scripting in eco All versions of eco are vulnerable to Cross-Site Scripting (XSS). The package’s default __escape implementation fails to escape single quotes, which may allow attackers to...	High	CWE-79
ReDOS vulnerabities: multiple grammars - highlight.js oswasp:	Medium	CWE-400
ReDOS vulnerabities: multiple grammars oswasp:	Medium	CWE-400
Sandbox Breakout / Arbitrary Code Execution in safer-eval - safer-eval - GHSA-876r-hj45-fw7g All versions of safer-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively...	High
Cross-Site Scripting in react Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package’s createElement function fails to properly validate its input object, allowing attackers...	High	CWE-79
Prototype Pollution in flat-wrap All versions of flat-wrap are vulnerable to prototype pollution. The function unflatten does not restrict the modification of an Object’s prototype, which may allow an...	High	CWE-1321
Prototype Pollution in safe-object2 - safe-object2 All versions of safe-object2 are vulnerable to prototype pollution. The settter() function does not restrict the modification of an Object’s prototype, which may allow an...	High	CWE-1321
Prototype Pollution in unflatten All versions of unflatten are vulnerable to prototype pollution. The function unflatten does not restrict the modification of an Object’s prototype, which may allow an...	High	CWE-1321
Client TLS credentials sent raw to server in npm package nats Nats is a Node.js client for the NATS messaging system.	High	CWE-522
Cross-Site Scripting in ngx-md Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead...	High	CWE-79
Path Traversal in sapper Versions of sapper prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing...	High	CWE-22
Potential XSS in jQuery dependency in Mirador Mirador users less than v3.0.0 (alpha-rc) versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be...	Medium	CWE-79
Prototype Pollution in json-logic-js Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through...	High	CWE-471
Unrestricted Upload of File with Dangerous Type in jquery-file-upload Arbitrary file upload in jQuery Upload File <= 4.0.2	High	CWE-434
Authentication Bypass in otpauth Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package’s totp.validate() function may return positive values for single digit tokens even if...	High	CWE-287
Cross-Site Scripting in console-feed Versions of console-feed prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses...	High	CWE-79
Malicious Package in rate-map Version 1.0.3 of rate-map contains malicious code. The malware breaks functionality of the purescript-installer package by rewriting code of the dl-tar dependency.	High	CWE-506
Prototype Pollution in lodash.merge - lodash.merge Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via...	High	CWE-1321
Prototype Pollution in lodash.mergewith - lodash.mergewith Versions of lodash.mergewith before 4.6.1 are vulnerable to Prototype Pollution. The function ‘mergeWith’ may allow a malicious user to modify the prototype of Object via...	High	CWE-1321
Prototype Pollution in lodash.mergewith Versions of lodash.mergewith before 4.6.2 are vulnerable to prototype pollution. The function mergeWith may allow a malicious user to modify the prototype of Object via...	High	CWE-1321
Cross-Site Scripting in mavon-editor All versions of mavon-editor are vulnerable to Cross-Site Scripting. The package fails to sanitize entered input, allowing attackers to execute arbitrary JavaScript in a victim’s...	Medium	CWE-79
Malicious Package in json-serializer Version 2.0.10 of json-serializer contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High
Cross-Site Scripting in markdown-to-jsx - markdown-to-jsx Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This...	High	CWE-79
Machine-In-The-Middle in airtable Affected versions of airtable are vulnerable to Machine-In-The-Middle. The package has SSL certificate validation disabled by default unintentionally. This may allow attackers in a privileged...	High
Arbitrary Code Execution in handlebars - handlebars - GHSA-q2c6-c6pm-g3gh Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package’s lookup helper fails to properly validate templates, allowing attackers...	High
Regular Expression Denial of Service in markdown All versions of markdown are vulnerable to Regular Expression Denial of Service (ReDoS). The markdown.toHTML() function has significantly degraded performance when parsing long strings containing...	Low	CWE-400
Cross-Site Scripting in nextcloud-vue-collections Versions of nextcloud-vue-collections prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to...	High	CWE-79
Outdated Static Dependency in vue-moment Versions of vue-moment prior to 4.1.0 contain an Outdated Static Dependency. The package depends on moment and has it loaded statically instead of as a...	Medium	CWE-1104
Regex denial of service vulnerability in codesample plugin A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the codesample plugin. The vulnerability allowed poorly formed ruby code samples to...	Low	CWE-400
Signatures are mistakenly recognized to be valid in jsrsasign In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known...	Medium	CWE-347
Hardcoded Initialization Vector in parsel All versions of parsel have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV...	High
Server-Side Request Forgery in @uppy/companion - @uppy/companion Versions of @uppy/companion prior to 1.9.3 are vulnerable to Server-Side Request Forgery (SSRF). The get route passes the user-controlled variable req.body.url to a GET request...	High	CWE-918
Verification flaw in Solid identity-token-verifier No description available.	Medium	CWE-290
Improperly Controlled Modification of Object Prototype Attributes The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not...	High	CWE-1321
Cross-site scripting vulnerability in TinyMCE - tinymce - GHSA-5vm8-hhgr-jcjp A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser for form elements. The vulnerability allowed arbitrary JavaScript execution...	Medium	CWE-79
Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages.	Medium	CWE-347
Regular Expression Denial of Service in millisecond Versions of millisecond prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.	Medium	CWE-400
Execution with Unnecessary Privileges in arc-electron When the end-user click on the response header that contains a link the target will be opened in ARC new window.	High
Removal of functional code in faker.js Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to...	High
Inefficient Regular Expression Complexity in Validator.js - validator Versions of validator prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the rtrim and trim sanitizers.	Medium	CWE-1333
Marked ReDoS due to email addresses being evaluated in quadratic time Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers...	Medium	CWE-400
fuelux vulnerable to Cross-Site Scripting in Pillbox feature Affected versions of fuelux contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it...	High	CWE-79
Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript Versions of pannellum prior to 2.5.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs for data URIs, which may allow attackers...	Medium	CWE-79
cookie-signature Timing Attack Affected versions of cookie-signature are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison.	Medium	CWE-362
Path traversal for local publishers in TechDocs backend A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend...	Medium
Arbitrary Code Execution in require-node Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to...	High	CWE-78
Regular Expression Denial of Service in slug Affected versions of slug are vulnerable to a regular expression denial of service when parsing untrusted user input.	Medium	CWE-400
Cleartext Transmission of Sensitive Information in moment-timezone No description available.	Medium	CWE-319
Command Injection in moment-timezone All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection.	Low
gatsby-transformer-remark has possible unsanitized JavaScript code injection The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its...	High	CWE-79
Cross-site Scripting in bootstrap-table - bootstrap-table This affects all versions of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the...	Low	CWE-843
RSSHub SSRF vulnerability RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers...	High	CWE-918
Prototype Pollution in chartkick Affected versions of @polymer/polymer are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such...	High
Improper Input Validation in url-js The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be...	Medium	CWE-20
Spoofing attack in swagger-ui-dist The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to...	Medium	CWE-1021
Sudden swap of user auth tokens in Volto Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that...	Medium	CWE-287
Cross-site Scripting in sanitize-url The package @braintree/sanitize-url before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the sanitizeUrl function.	Medium	CWE-79
Server-Side Request Forgery in FUXA A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server’s internal environment...	High	CWE-918
Command injection in launchpad All versions of package launchpad are vulnerable to Command Injection via stop.	High	CWE-77
yargs-parser Vulnerable to Prototype Pollution Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the...	Medium	CWE-915
Prototype Pollution in algoliasearch-helper The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties....	High	CWE-915
Cross-site Scripting in CKEditor4 The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.	Medium	CWE-79
Prototype Pollution in mathjs The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.	High	CWE-915
Prototype Pollution in mout - mout This affects all versions of package mout. The deepFillIn function can be used to ‘fill missing properties recursively’, while the deepMixIn ‘mixes objects into the...	High	CWE-1321
Prototype Pollution in set-in The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it....	High	CWE-1321
Prototype pollution vulnerability in js-extend Prototype pollution vulnerability in ‘js-extend’ versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.	High	CWE-915
Failure to validate signature during handshake @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process.This may allow a man-in-the-middle to pose as other peers and get...	High	CWE-347
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML The vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4.	High	CWE-79
modern-async's `forEachSeries` and `forEachLimit` functions do not limit the number of requests This is a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in...	High	CWE-770
Prototype Pollution in ts-nodash ts-nodash before version 1.2.7 is vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.	High	CWE-915
Utils.readChallengeTx does not verify the server account signature The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that...	Medium	CWE-347
Prototype Pollution in libnested The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. Note: This vulnerability derives from an incomplete fix for...	High	CWE-1321
Command Injection in ungit The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled...	High	CWE-77
Prototype pollution in supermixer Prototype pollution in Stampit supermixer allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation....	High	CWE-1321
Cross-site Scripting in @rocket.chat/livechat A blind self XSS vulnerability exists in RocketChat LiveChat versions lower than 1.9 that could allow an attacker to trick a victim pasting malicious code...	Medium	CWE-79
URL Confusion When Scheme Not Supplied in medialize/uri.js Medialize is a Javascript URL mutation library. When parsing a URL without a scheme and with excessive slashes, like ///www.example.com, URI.js will parse the hostname...	Medium	CWE-601
Cross site scripting in valine valine is a fast, simple & powerful comment system. Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. A...	Medium	CWE-79
Cross-site Scripting in tableexport.jquery.plugin There is a cross-site scripting vulnerability with default onCellHtmlData function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. This can result in transmitting cookies to third-party...	Medium	CWE-79
Prototype Pollution in fullpage.js fullPage utils are available to developers using window.fp_utils. They can use these utils for their own use-case (other than fullPage) as well. However, one of...	High	CWE-1321
Cross-site Scripting in fullpage.js using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow for...	Medium	CWE-79
Prototype Pollution in madlib-object-utils The package madlib-object-utils before version 0.1.8 is vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into...	High	CWE-1321
Unrestricted Upload of File with Dangerous Type in ButterCMS An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.	High	CWE-434
Unrestricted Upload of File with Dangerous Type in Payload An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.	High	CWE-434
Improper handling of multiline messages in node-irc affects matrix-appservice-irc matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having...	High	CWE-74
Cross-site Scripting in Auth0 Lock In versions before and including 11.32.2, when the “additional signup fields” feature is configured, a malicious actor can inject invalidated HTML code into these additional...	Medium	CWE-79
Prototype Pollution in json-pointer This affects versions of package json-pointer up to and including 0.6.1. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer...	Medium	CWE-843
x-data-spreadsheet through 1.1.9 vulnerable to Cross-site Scripting All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of values inserted into the cells.	Medium	CWE-79
Prototype pollution in dojo - dojo In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution.	High	CWE-94
Improper Neutralization of Input During Web Page Generation in CKEditor4 A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user...	Medium	CWE-79
Improper Neutralization of Input During Web Page Generation in swagger-ui swagger-ui has XSS in key names	Medium	CWE-79
Improper Control of Generation of Code in doT The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if...	High	CWE-94
Improper Neutralization of Input During Web Page Generation in Select2 In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when...	Medium	CWE-79
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi - @strapi/strapi An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other...	High	CWE-212
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API...	High	CWE-212
Improper Input Validation in Deap The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker...	High	CWE-20
AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes Versions of angular prior to 1.5.0-beta.1 are vulnerable to Cross-Site Scripting. The package fails to sanitize xlink:href attributes, which may allow attackers to execute arbitrary...	Medium	CWE-79
cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch If a vunerable version of cruddl is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary...	High	CWE-74
OpenPGP 1.2.0 and earlier decrypts arbitrary messages s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is...	High
Unsanitized JavaScript code injection possible in gatsby-plugin-mdx The gatsby-plugin-mdx plugin prior to versions 3.15.2 and 2.14.1 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its...	High	CWE-502
Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy The nestjs-proxy library did not have a way to block sensitive cookies (e.g. session cookies) from being forwarded to backend services configured by the application...	Medium	CWE-200
Improper handling of CSS at-rules in lettersanitizer All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes.	High	CWE-754
Hostname confusion in parse-url Exposure of Sensitive Information to an Unauthorized Actor via hostname confusion in GitHub repository ionicabizau/parse-url prior to 6.0.1	High	CWE-200
Server-Side Request Forgery in parse-url Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.	High	CWE-918
Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy The nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application...	Medium	CWE-200
jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method Summary	High	CWE-1333
Cross site scripting in parse-url Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 6.0.1	Medium	CWE-79
Prototype Pollution in deep-get-set All versions of package deep-get-set are vulnerable to Prototype Pollution via the ‘deep’ function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715	High	CWE-1321
JWS and JWT signature validation vulnerability with special characters Jsrsasign supports JWS(JSON Web Signatures) and JWT(JSON Web Token) validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters...	High	CWE-347
Regular expression denial of service in react-native A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This...	High	CWE-697
Server-Side Request Forgery in link-preview-js The package link-preview-js before 2.1.17 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read...	Medium	CWE-918
Cross site scripting in parse-url - parse-url Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.	Medium	CWE-79
Authorization Bypass in parse-path Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.	High	CWE-639
set-deep-prop Prototype Pollution All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.	High	CWE-1321
ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse` This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they...	High	CWE-1321
node-import `params` argument can be controlled by users without any sanitization This affects all versions of package node-import. The params argument of module function can be controlled by users without any sanitization. This is then provided...	High
ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the merge function.	High	CWE-1321
markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.	Medium	CWE-79
grapesjs before 0.19.5 vulnerable to Cross-site Scripting The package grapesjs before 0.19.5 is vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.	Medium	CWE-79
Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.	High	CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype....	Medium	CWE-915
Prototype Pollution in cookiex/deep The npm @cookiex/deep package before version 0.0.7 has a prototype pollution vulnerability. The global proto object can be polluted using the proto object.	High	CWE-915
Uncontrolled Resource Consumption in fun-map fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of ‘Object.prototype’ using a ‘proto’ payload....	High	CWE-915
Prototype Pollution in arr-flatten-unflatten All versions of package arr-flatten-unflatten up to and including version 1.1.4 are vulnerable to Prototype Pollution via the constructor.	High	CWE-1321
Prototype pollution in class-transformer class-transformer through 0.2.3 is vulnerable to Prototype Pollution. The ‘classToPlainFromExist’ function could be tricked into adding or modifying properties of ‘Object.prototype’ using a ‘proto’ payload....	Medium	CWE-915
Prototype Pollution in madlib-object-utils - madlib-object-utils madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.	High	CWE-915
Prototype Pollution in x-assign This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the proto object.	High	CWE-915
Solana Pay Vulnerable to Weakness in Transfer Validation Logic When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the...	Medium	CWE-670
Cross-Site Scripting in min-http-server All versions of min-http-server are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim’s...	Medium	CWE-79
Prototype pollution in chart.js This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing...	High	CWE-915
Prototype Pollution in property-expr The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.	High	CWE-915
RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign Jsrsasign can verify RSA-PSS signature which value can expressed as BigInteger. When there is a valid RSA-PSS signature value, this vulnerability is also accept value...	High	CWE-119
Cross site scripting in mobiledoc-kit Cross-site Scripting (XSS) - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2.	Medium	CWE-79
Uncontrolled Resource Consumption in node-opcua The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per...	High	CWE-400
parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing parse-url prior to 8.1.0 is vulnerable to Misinterpretation of Input. parse-url parses certain http or https URLs incorrectly, identifying the URL’s protocol as ssh. It...	Medium	CWE-115
Matrix-appservice-irc vulnerable to sql injection via roomIds argument A vulnerability was found in matrix-appservice-irc up to 0.35.1. This vulnerability affects the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection....	Medium	CWE-89
deep-object-diff vulnerable to Prototype Pollution deep-object-diff before version 1.1.6 allows an external attacker to edit or add new properties to an object. This is possible because the application does not...	Medium	CWE-1321
Cross-site scripting vulnerability in TinyMCE alerts A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur...	Medium	CWE-79
@cubejs-backend/api-gateway row level security bypass All authenticated Cube clients could bypass row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint.	High	CWE-89
dustjs-linkedin vulnerable to Prototype Pollution A vulnerability was found in LinkedIn dustjs prior to version 3.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation...	High	CWE-94
Jodit Editor vulnerable to Cross-site Scripting - jodit Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting...	Medium	CWE-79
secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.	High	CWE-347
matrix-appservice-irc vulnerable to IRC mode parameter confusion IRC allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc...	Medium	CWE-269
Parsing issue in matrix-org/node-irc leading to room takeovers Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to...	High	CWE-269
@mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS) The sanitize-svg package uses a deny-list-pattern to sanitize SVGs to prevent cross-site scripting (XSS). In doing so, literal <script>-tags and on-event handlers were detected:	High	CWE-79
Cross-site Scripting in Joplin An XSS issue in Joplin desktop allows arbitrary code execution via a malicious HTML embed tag.	Medium	CWE-79
inflect vulnerable to Inefficient Regular Expression Complexity inflect is customizable inflections for nodejs. inflect is vulnerable to Inefficient Regular Expression Complexity	High	CWE-1333
merge vulnerable to Prototype Pollution merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)	High	CWE-915
cumulative-distribution-function Infinite Loop vulnerability A flaw enabling an infinite-loop was discovered in the code for evaluating the cumulative-distribution-functionof input data. Although the documentation explains that numeric data is required,...	High	CWE-835
prismjs Regular Expression Denial of Service vulnerability Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide...	Medium	CWE-400
Improper Input Validation in Google Closure Library A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to...	Medium	CWE-20
deep-parse-json vulnerable to Prototype Pollution deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly...	Medium	CWE-1321
Improper Control of Generation of Code ('Code Injection') in mdx-mermaid Arbitary javascript injection	Low	CWE-94
DOM-based cross-site scripting in Froala Editor Froala WYSIWYG HTML Editor is a lightweight WYSIWYG HTML Editor written in JavaScript that enables rich text editing capabilities for web applications. A DOM-based cross-site...	Medium	CWE-79
Options structure open to Cross-site Scripting if passed unfiltered In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted...	High	CWE-79
Prototype poisoning The issue is as follows: when msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to __proto__. As you are no...	Medium	CWE-915
Remote code execution in Eclipse Theia In Eclipse Theia 0.3.9 to 1.8.1, the “mini-browser” extension allows a user to preview HTML files in an iframe inside the IDE. But with the...	High	CWE-942
Joplin is vulnerable to arbitrary code execution Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.	High	CWE-79
Smoothie vulnerable to Cross-site Scripting when tooltipLabel or strokeStyle are controlled by users The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties....	Medium	CWE-79
node-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limit The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA...	High	CWE-770
node-opcua DoS when bypassing limitations for excessive memory consumption The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests...	High	CWE-400
matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of...	High	CWE-322
steal vulnerable to Prototype Pollution via optionName variable Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.	High	CWE-1321
Inefficient Regular Expression Complexity in vuelidate vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS (regular expression denial of service) flaw was found in the @vuelidate/validators...	High	CWE-697
TypeORM vulnerable to MAID and Prototype Pollution Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or...	High	CWE-471
Improper beacon events in matrix-js-sdk can result in availability issues Improperly formed beacon events (from MSC3488) can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer’s ability to process data safely. Note...	Medium	CWE-20
steal vulnerable to Prototype Pollution via key variable in babel.js Prototype pollution vulnerability in function extend in babel.js in stealjs steal via the key variable in babel.js.	High	CWE-1321
steal vulnerable to Prototype Pollution via requestedVersion variable Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal via the requestedVersion variable in the npm-convert.js file.	High	CWE-1321
matrix-js-sdk subject to impersonated messages due to permissive key forwarding An attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey...	High	CWE-287
CKEditor 5 Markdown plugin Regular expression Denial of Service A regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link...	Medium	CWE-400
matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion An attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a...	High	CWE-322
ejs template injection vulnerability The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and...	High	CWE-74
@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track frontend renders them using the JavaScript library Showdown. Showdown does not...	Medium	CWE-79
jsx-slack insufficient patch for CVE-2021-43838 ReDoS We found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient to save from Regular Expression Denial of Service (ReDoS) attack.	Medium	CWE-400
jquery.terminal self XSS on user input This is low impact and limited XSS, because code for XSS payload is always visible, but attacker can use other techniques to hide the code...	Low	CWE-80
Vuetify Cross-site Scripting vulnerability The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the ‘eventName’ function within the...	Medium	CWE-79
Prototype Pollution in mout This affects all versions of package mout. The deepFillIn function can be used to ‘fill missing properties recursively’, while the deepMixIn mixes objects into the...	High	CWE-1321
Fastly Compute@Edge JS Runtime has fixed random number seed during compilation Math.random and crypto.getRandomValues methods failed to use sufficiently random values. The initial value to seed the CSPRNG (cryptographically secure pseudorandom number generator) was baked-in to...	High	CWE-335
React Editable Json Tree vulnerable to arbitrary code execution via function parsing Our library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript’s eval function was used to...	High	CWE-95
Cross-site Scripting (XSS) in serve-lite All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file...	Medium	CWE-79
Directory Traversal vulnerability in serve-lite All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url...	High	CWE-22
TaffyDB can allow access to any data items in the DB - taffy TaffyDB allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. Taffy...	High	CWE-668
TaffyDB can allow access to any data items in the DB TaffyDB allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. Taffy...	High	CWE-668
RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign Jsrsasign supports RSA PKCS#1 v1.5 (i.e. RSAES-PKCS1-v1_5) and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted...	High	CWE-119
ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign Jsrsasign supports ECDSA signature validation which signature value is represented by ASN.1 DER encoding. This vulnerablity may accept a wrong ASN.1 DER encoded ECDSA signature...	High	CWE-347
Prototype Pollution in dojo All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.	High	CWE-1321
Path Traversal in mcstatic All versions of mcstatic are vulnerable to path traversal.	High	CWE-22
metascraper before v5.2.0 vulnerable to stored cross-site scripting Versions of metascraper prior to 5.2.0 are vulnerable to stored cross-site scripting (XSS).	Medium	CWE-79
CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-html-support @ckeditor/ckeditor5-markdown-gfm@ckeditor/ckeditor5-html-support@ckeditor/ckeditor5-html-embed	Medium	CWE-79
CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-markdown-gfm @ckeditor/ckeditor5-markdown-gfm@ckeditor/ckeditor5-html-support@ckeditor/ckeditor5-html-embed	Medium	CWE-79
CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process @ckeditor/ckeditor5-markdown-gfm@ckeditor/ckeditor5-html-support@ckeditor/ckeditor5-html-embed	Medium	CWE-79
@ianwalter/merge Prototype Pollution via `merge` function All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. @ianwalter/merge is deprecated and the maintainer suggests using @generates/merger instead....	Medium	CWE-1321
Nadesiko3 OS Command Injection vulnerability OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.68 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and...	High	CWE-78
nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit Nako3edit is the editor component of Nadeshiko 3, a programming language developed based on Japanese. Improper check or handling of exceptional conditions in Nako3edit v3.3.74...	Medium	CWE-755
nadesiko3 vulnerable to OS Command Injection OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product...	High	CWE-78
steal vulnerable to Prototype Pollution Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.	High	CWE-1321
Valine code injection vulnerability Valine was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.	High	CWE-79
Toast UI Grid vulnerable to Cross-site Scripting Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted...	Medium	CWE-79
steal vulnerable to Prototype Pollution via alias variable Prototype pollution vulnerability in stealjs steal via the alias variable in babel.js.	High	CWE-1321
Regular Expression Denial of Service in ua-parser-js The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA....	High	CWE-400
Prototype Pollution in dset All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating...	Medium	CWE-1321
materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a-tag />) that is being...	Medium	CWE-79
Privilege Issues in jailed All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored...	High
Prototype Pollution in Dexie Dexie is a minimalistic wrapper for IndexedDB. The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj,...	High	CWE-1321
Insecure password handling vulnerability in Strapi Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a...	High	CWE-922
Cross-site Scripting in video.js This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.	Medium	CWE-79
Cross-site Scripting in jquery.json-viewer The jquery.json-viewer library before version 1.5.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT...	Medium	CWE-79
Cross-site Scripting in pandao editor.md pandao Editor.md 1.5.0 allows XSS via the Javascript: string.	Medium	CWE-79
Invalid Curve Attack in openpgp Versions of openpgp prior to 4.3.0 are vulnerable to an Invalid Curve Attack. The package’s implementation of ECDH fails to verify the validity of the...	Medium	CWE-327
Cross-site Scripting in node-red-dashboard It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.	Medium	CWE-79
Sandbox Breakout / Arbitrary Code Execution in safer-eval - safer-eval - GHSA-hgch-jjmr-gp7w Versions of safer-eval before 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and...	High	CWE-94
Cross-site Scripting in pandao pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.	Medium	CWE-79
Sandbox Breakout / Arbitrary Code Execution in safer-eval - safer-eval - GHSA-r3x4-wr4h-pw33 Versions of safer-eval prior to 1.3.4 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox...	High	CWE-94
XSS in knockout There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its...	Medium	CWE-79
Uncaught exception in engine.io A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.	Medium	CWE-248
Denial of Service and Content Injection in i18n-node-angular Versions of i18n-node-angular prior to 1.4.0 are affected by denial of service and cross-site scripting vulnerabilities. The vulnerabilities exist in a REST endpoint that was...	High	CWE-74
Sandbox Breakout / Arbitrary Code Execution in safer-eval - safer-eval All versions of safer-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and...	High	CWE-94
node-red-dashboard vulnerable to Cross-site Scripting node-red-dashboard contains a cross-site scripting vulnerability. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The attack may...	Medium	CWE-79
Cross-Site Scripting in @novnc/novnc Versions of @novnc/novnc prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as...	Medium	CWE-79
Cross-site Scripting in Joplin - joplin - GHSA-6r7x-hc8m-985r Joplin through 1.0.184 allows Arbitrary File Read via Cross-site Scripting (XSS).	Medium	CWE-79
Unprotected dynamically loaded chunks All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes...	Low	CWE-345
Prototype Pollution in highlight.js Affected versions of this package are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of...	Medium	CWE-471
Axios vulnerable to Server-Side Request Forgery Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that...	Medium	CWE-918
regular expression denial of service (ReDoS) - date-and-time date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be...	High	CWE-400
Regular Expression Denial of Service (REDoS) in Marked Regular expression Denial of Service	Medium	CWE-400
SSRF in Rendertron Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force...	Medium	CWE-918
Prototype pollution in JointJS - jointjs The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object’s key and set the value...	High	CWE-400
Angular Expressions - Remote Code Execution The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input.	High	CWE-94
Prototype pollution in set-in - set-in Prototype pollution vulnerability in ‘set-in’ versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.	High	CWE-1321
Cross-site Scripting in vis-timeline This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code...	Medium	CWE-79
Regular expression Denial of Service in @progfay/scrapbox-parser A Regular expression Denial of Service flaw was found in the @progfay/scrapbox-parser package before 6.0.3, 7.0.2 for Node.js.The attacker that is able to be parsed...	Medium	CWE-400
Cross-site Scripting (XSS) in Eclipse Theia In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.	High	CWE-79
[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values Potential for arbitrary code execution in #gpg-tagged property values (only if decrypt: true option is enabled)	Medium	CWE-78
Prototype Pollution Vulnerability in object-collider Prototype pollution vulnerability in ‘object-collider’ versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.	High	CWE-1321
Denial of Service (DoS) via the unsetByPath function in jsjoints The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.	High	CWE-400
Hostname spoofing via backslashes in URL If using affected versions to determine a URL’s hostname, the hostname can be spoofed by using a backslash (\) character followed by an at (@)...	Medium	CWE-20
Improper Neutralization of Input in Theia console In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected....	Medium	CWE-79
XSS in Vega Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package.In Vega before version 5.17.3...	Low	CWE-79
Cross-site scripting in SocksJS-node htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.	Medium	CWE-79
Path traversal in Node-RED-Dashboard In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows ui_base/js/..%2f directory traversal to read files.	High	CWE-22
Prototype Pollution in dot-object dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a proto payload....	Medium	CWE-74
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-engine A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...	Medium	CWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-font A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...	Medium	CWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-image A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...	Medium	CWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-list A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...	Medium	CWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-media-embed A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...	Medium	CWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-paste-from-office A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...	Medium	CWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-widget A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...	Medium	CWE-400
Regular expression Denial of Service in multiple packages A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...	Medium	CWE-400
Server-Side Request Forgery in private-ip Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF.	High	CWE-918
Prototype Pollution in decal - decal This affects all versions of package decal. The vulnerability is in the set function.	High	CWE-400
Regular Expression Denial of Service (ReDoS) in ua-parser-js ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header,...	High	CWE-400
Arbitrary code execution in djv This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.	High	CWE-94
Prototype pollution in set-object-value Prototype pollution vulnerability in ‘set-object-value’ versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution....	High	CWE-1321
Prototype Pollution in copy-props The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.	High	CWE-1321
Regular Expression Denial of Service in hosted-git-info The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js....	Medium	CWE-400
Improper Input Validation in klona Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or...	High	CWE-20
Improper Input Validation in sanitize-html - sanitize-html Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the “allowedIframeHostnames” option when the “allowIframeRelativeUrls” is set to true, which allows...	Medium	CWE-20
Insufficient Verification of Data Authenticity in Eclipse Theia In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is “Mini-Browser”, published as “@theia/mini-browser” on npmjs.com.	High	CWE-345
Improper Input Validation in SocksJS-Node Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.	Medium	CWE-20
Prototype Pollution in undefsafe undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The ‘a’ function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload....	Medium	CWE-74
Resource exhaustion in socket.io-parser The socket.io-parser npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a...	High	CWE-400
Padding Oracle Attack due to Observable Timing Discrepancy in jose jose is an npm library providing a number of cryptographic operations.	Medium	CWE-696
Prototype pollution in json8-merge-patch Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.	High	CWE-471
Cross-site Scripting in reveal.js - reveal.js Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks.	Medium	CWE-79
Improper Authentication in react-adal This affects versions of react-adal < 0.5.1. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and...	High	CWE-287
Prototype pollution in pathval A prototype pollution vulnerability affects all versions of package pathval under 1.1.1.	High	CWE-20
Prototype Pollution in set-or-get Prototype pollution vulnerability in ‘set-or-get’ version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution....	High	CWE-1321
Regular expression denial of service in codemirror This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129.	Medium	CWE-400
Regular Expression Denial of Service in dat.gui All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.	High	CWE-400
Regular Expression Denial of Service in trim All versions of package trim lower than 0.0.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().	High	CWE-400
Cross-site scripting in @atlaskit/editor-core The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in...	Medium	CWE-79
Buffer overflow in canvas A buffer overflow is present in canvas versions before 1.6.11, which could lead to a Denial of Service or execution of arbitrary code when it...	High	CWE-120
Prototype pollution in json8 This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly...	High	CWE-1321
Prototype Pollution in node-oojs All versions of package node-oojs up to and including version 1.4.0 are vulnerable to Prototype Pollution via the setPath function.	High	CWE-1321
Prototype Pollution in phpjs All versions of phpjs up to and including 1.3.2 are vulnerable to Prototype Pollution via parse_str. phpjs is no longer maintained and users are advised...	High	CWE-1321
Prototype Pollution in promisehelpers All versions of package promisehelpers up to and including version 0.0.5 are vulnerable to Prototype Pollution via the insert function.	High	CWE-1321
Regular expression denial of service in @absolunet/kafe This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.	Medium	CWE-400
Path traversal in rollup-plugin-serve Path traversal in npm package rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation.	High	CWE-22
Prototype Pollution in tiny-conf All versions of package tiny-conf up to and including version 1.1.0 are vulnerable to Prototype Pollution via the set function.	High	CWE-1321
Improper Input Validation in access-policy access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the template function is executed by the eval function resulting in code...	High	CWE-94
Improper parsing of octal bytes in netmask Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks...	High	CWE-20
Prototype Pollution in gedi All versions of package gedi up to and including version 1.6.3 are vulnerable to Prototype Pollution via the set function.	High	CWE-1321
Insecure template handling in haml-coffee haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding...	High	CWE-79
Regular Expression Denial of Service in postcss - postcss The npm package postcss from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing....	Medium	CWE-400
Cross-site scripting in Joplin - joplin Joplin allows XSS via a LINK element in a note.	Medium	CWE-79
Cross-site Scripting in aurelia-framework The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter...	Medium	CWE-79
Validation bypass in jpv jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.	High	CWE-20
Command Injection in @theia/messages In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.	Medium	CWE-829
Exposure of Resource to Wrong Sphere in valib valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function...	Medium	CWE-668
Prototype Pollution in swiper Versions of the package swiper before 6.5.1 are susceptible to prototype pollution.	High	CWE-1321
ua-parser-js Regular Expression Denial of Service vulnerability The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).	High	CWE-400
Injection and Command Injection in devcert A command injection vulnerability in the devcert module may lead to remote code execution when users of the module pass untrusted input to the certificateFor...	High	CWE-78
Uncontrolled Resource Consumption in firebase This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided,...	Medium	CWE-400
Code Injection in cd-messenger cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the color argument executed by the eval function resulting in code execution....	High	CWE-94
Prototype pollution in controlled-merge Prototype pollution vulnerability in ‘controlled-merge’ versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.	High	CWE-1321
Prototype Pollution in deep-get-set - deep-get-set All versions of package deep-get-set prior to version 1.1.1 are vulnerable to Prototype Pollution via the main function.	High	CWE-1321
Prototype Pollution in safe-object2 All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.	High	CWE-1321
Cross-site Scripting in docsify docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files....	Medium	CWE-79
Code Injection in mosc mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to properties argument is executed by the eval function, resulting in code execution....	High	CWE-94
Prototype Pollution in deep-override Prototype pollution vulnerability in ‘deep-override’ versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution....	High	CWE-1321
Cross-site scripting in react-bootstrap-table All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is...	Medium	CWE-79
Regular Expression Denial of Service (ReDoS) in Prism Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).	High	CWE-400
Widget feature vulnerability allowing to execute JavaScript code using undo functionality The vulnerability has been discovered in Widget plugin if used alongside Undo feature.	High	CWE-79
Prototype pollution in safe-obj Prototype pollution vulnerability in ‘safe-obj’ versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution....	High	CWE-1321
Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality The vulnerability has been discovered in clipboard plugin. All plugins with clipboard plugin dependency are affected:	Medium	CWE-94
Denial of service in Valine Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a...	Medium	CWE-94
Reflected XSS when using flashMessages or languageDictionary Versions before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library’s flashMessage feature is utilized and user...	High	CWE-79
Passing in a non-string 'html' argument can lead to unsanitized output A type-confusion vulnerability can cause striptags to concatenate unsanitized strings when an array-like object is passed in as the html parameter. This can be abused...	Medium	CWE-843
ReDOS in IS-SVG A vulnerability was discovered in IS-SVG version 4.3.1 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and...	High	CWE-770
Regular Expression Denial of Service (ReDOS) - color-string In the npm package color-string, there is a ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity forlinearly increasing input lengths for...	Medium	CWE-770
Cross-site Scripting in curly-bracket-parser This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.	Medium	CWE-79
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML. The vulnerability has been discovered in Fake Objects plugin. All plugins with Fake Objects plugin dependency are affected:	High	CWE-79
Prototype Pollution in deepmergefn All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.	Medium	CWE-915
Clipboard-based DOM-XSS A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library.	Medium	CWE-79
Prototype Pollution in mootools This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()	Medium	CWE-1321
Incorrect Calculation in the MSR JavaScript Cryptography Library A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography (ECC)...	High	CWE-682
Cross-site Scripting in file-upload-with-preview This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked...	Medium	CWE-79
Prototype Pollution in jointjs This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the...	Medium	CWE-843
Uncontrolled Resource Consumption in transpile All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception...	Medium	CWE-755
Path traversal A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for docs_dir in...	Medium	CWE-22
Prototype pollution vulnerability in 'patchmerge Prototype pollution vulnerability in ‘patchmerge’ versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution....	High	CWE-1321
Script injection - @backstage/plugin-techdocs A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This may give access to...	Medium	CWE-77
Script injection A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by...	Medium	CWE-77
Cross-site Scripting in jsoneditor Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.	Medium	CWE-79
Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4 It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor,...	Medium	CWE-829
Basic-auth app bundle credential exposure in gatsby-source-wordpress The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not...	High	CWE-522
Cross-site Scripting in Mermaid Mermaid before 8.11.0 allows XSS when the antiscript feature is used.	Medium	CWE-79
Cross-site Scripting in tempura This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without...	Medium	CWE-79
Improper Input Validation in is-email is-email helps validate an email address. A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js....	High	CWE-400
Prototype pollution in aurelia-path The vulnerability exposes Aurelia application that uses aurelia-path package to parse a string. The majority of this will be Aurelia applications that employ the aurelia-router...	High	CWE-915
XSS vulnerability allowing arbitrary JavaScript execution Today we are releasing Grafana 8.2.3. This patch release includes an important security fix for an issue that affects all Grafana versions from 8.0.0-beta1.	Medium	CWE-79
Cross-site scripting in anchorme All versions of package anchorme are vulnerable to Cross-site Scripting (XSS) via the main functionality.	Medium	CWE-79
Cross-site Scripting in Froala Editor - froala-editor Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within...	Medium	CWE-79
Cross Site Request Forgery in kindeditor Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x. First, you upload an html file containing csrf on the website that uses a google...	High	CWE-352
GraphiQL introspection schema template injection attack This is a security advisory for an XSS vulnerability in graphiql.	High	CWE-79
Unauthorized access to data in @sap-cloud-sdk/core This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations.In some cases, when user information was...	Medium	CWE-200
Uncontrolled Resource Consumption in trim-off-newlines All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.	Medium	CWE-400
Prototype Pollution in merge-change All current versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.	High	CWE-915
Unsafe defaults in `remark-html` The documentation of remark-html has mentioned that it was safe by default. In practise the default was never safe and had to be opted into....	High	CWE-79
Prototype pollution vulnerability in 'deepref Prototype pollution vulnerability in ‘deepref’ versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.	High
Cross-site Request Forgery (CSRF) in joplin The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.	Medium	CWE-352
Cross site scripting in kindeditor Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this...	Medium	CWE-79
Prototype Pollution in Proto This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge...	High	CWE-1321
Clipboard-based XSS XSS against the user.	High	CWE-79
Improper Verification of Communication Channel in @theia/plugin-ext In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().	Medium	CWE-940
Code injection in plupload This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a...	Medium	CWE-75
Prototype pollution vulnerability in 'libnested Prototype pollution vulnerability in ‘libnested’ versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution....	High
Risk of code injection Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side security issues	High	CWE-74
Insecure random number generation in keypair A bug in the pseudo-random number generator used by keypair versions up to and including 1.0.3 could allow for weak RSA key generation. This could...	High	CWE-335
Cross-Site Scripting Vulnerability in @joeattardi/emoji-button There are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2:	High	CWE-79
Prototype Pollution in dotty - dotty This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the...	Medium	CWE-843
Cross-site Scripting in pekeupload This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code...	Medium	CWE-79
Prototype Pollution in @fabiocaccamo/utils.js utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’).	High	CWE-1321
Strapi mishandles hidden attributes within admin API responses Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.	High	CWE-89
Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component...	Medium	CWE-1022
Misinterpretation of malicious XML input - xmldom - GHSA-h6q6-9hqw-rwfv xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.	Medium	CWE-436
liquidjs may leak properties of a prototype The package liquidjs before 10.0.0 is vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype....	Medium	CWE-200
Expo on iOS is insecure due incorrect security attribute application secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.	Medium
Markdown-Nice v1.8.22 vulnerable to Cross-site Scripting A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community...	Medium	CWE-79
Cross-site Scripting in Bootstrap-3-Typeahead Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute...	Medium	CWE-79
Cross-site Scripting in bootstrap-table Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure...	Medium	CWE-79
markdown-it vulnerable to Inefficient Regular Expression Complexity A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The...	High	CWE-1333
string-kit Inefficient Regular Expression Complexity vulnerability A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation...	High	CWE-1333
Json2html vulnerable to cross-site scripting Json2html is a client side javascript HTML templating library with wrappers for both jQuery and Node.js. A vulnerability was found in moappi Json2html up to...	Medium	CWE-79
Cross site scripting in Metro UI Metro UI v4.4.0 to v4.5.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function. User input is not properly sanitized...	Medium	CWE-79
Regular Expression Denial of Service in moment - moment Versions of moment prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is...	Medium	CWE-400
Prototype Pollution in js-data - js-data All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442.	High	CWE-1321
uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) - uppy uppy’s companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.	High	CWE-918
Reflected cross-site scripting (XSS) vulnerability This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package.	High	CWE-79
Incorrect sanitisation function leads to `XSS` in mermaid Malicious diagrams can contain javascript code that can be run at diagram readers machines.	High	CWE-79
Prototype Pollution in realms-shim - realms-shim All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.	High	CWE-1321
Prototype Pollution in realms-shim All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.	High	CWE-1321
Cross site scripting in three.js Versions of three.js prior to 0.137.0 load untrusted iframes and allow for attackers to inject arbitrary javascript into a users browser.	High	CWE-79
Exposure of Sensitive Information in simple-get In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially...	High	CWE-200
Prototype Pollution in keyget The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a...	Medium	CWE-1321
Cross-site Scripting in karma karma prior to version 6.3.14 contains a cross-site scripting vulnerability.	Medium	CWE-79
Server-Side Request Forgery in @peertube/embed-api @peertube/embed-api version 4.0.0 and prior is vulnerable to server-side request forgery.	Medium	CWE-918
Cross site scripting in @awsui/components-react Components could potentially allow cross-site scripting (XSS) in certain circumstances. These components could render content without adequate neutralization.	High	CWE-79
Open redirect in karma Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.	Medium	CWE-601
Authorization Bypass Through User-Controlled Key in urijs Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647.	Medium	CWE-639
Prototype Pollution in litespeed.js and appwrite/server-ce This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl...	High	CWE-1321
Leading white space bypasses protocol validation Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail.	Medium	CWE-20
Prototype Pollution in object-extend The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend.	High	CWE-1321
Cross-site Scripting in Prism Prism’s Command line plugin can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading...	High	CWE-79
Cross site scripting in reveal.js The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage.	Medium	CWE-79
Open Redirect in urijs urijs prior to version 1.19.10 is vulnerable to open redirect. This is the result of a bypass for the fix to CVE-2022-0613.	Medium	CWE-601
Eta vulnerable to Code Injection via templates rendered with user-defined data Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from...	High	CWE-94
Joplin Desktop App vulnerable to Cross-site Scripting Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.	Medium	CWE-79
XSS Attack with Express API XSS attack - anyone using the Express API is impacted	High	CWE-79
Cross site scripting in froala-editor A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor allows attackers to execute arbitrary web scripts or HTML.	Medium	CWE-79
Cross site scripting Vulnerability in backstage Software Catalog - @backstage/core-components This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs...	Medium	CWE-79
Cross site scripting Vulnerability in backstage Software Catalog This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs...	Medium	CWE-79
jSuites subect to Cross-site Scripting Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Editor() function.	Medium	CWE-79
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) When using the non-default “fallback” crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an...	High	CWE-835
iziModal Cross-site Scripting vulnerability iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles.	Medium	CWE-79
Baremetrics date range picker vulnerable to Cross-site Scripting The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior...	Medium	CWE-79
textAngular Cross-site Scripting vulnerability textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the...	Medium	CWE-79
Mind-elixir Cross-site Scripting vulnerability Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusted menus. This issue...	Medium	CWE-79
Cross-Site-Scripting attack on `<RichTextField>` - react-admin All React applications built with react-admin and using the <RichTextField> are affected.	Medium	CWE-79
Cross-Site-Scripting attack on `<RichTextField>` All React applications built with react-admin and using the <RichTextField> are affected.	Medium	CWE-79
Cross-site scripting in CKEditor5 CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget.	Medium	CWE-79
Cross-site Scripting in dijit editor's LinkDialog plugin XSS possible for users of the Dijit Editor’s LinkDialog plugin	Low	CWE-79
Path Traversal in localhost-now - localhost-now - GHSA-2gjg-5x33-mmp2 Versions of localhost-now before 1.0.2 are vulnerable to path traversal. This allows a remote attacker to read the content of an arbitrary file.	High	CWE-22
Cross-site Scripting in jspreadsheet The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS).	Medium	CWE-79
Vega vulnerable to arbitrary code execution when clicking href links Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.	Medium
@braintree/sanitize-url Cross-site Scripting vulnerability sanitize-url (aka @braintree/sanitize-url) before 6.0.1 allows XSS via HTML entities.	Medium	CWE-79
rangy vulnerable to Prototype Pollution All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can...	High	CWE-1321
xterm vulnerable to remote code execution A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters.	High	CWE-94
mde utilities contains Prototype Pollution All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.	High	CWE-1321
Vega Expression Language `scale` expression function Cross Site Scripting - vega The Vega scale expression function has the ability to call arbitrary functions with a single controlled argument. This can be exploited to escape the Vega...	Medium	CWE-79
Vega Expression Language `scale` expression function Cross Site Scripting The Vega scale expression function has the ability to call arbitrary functions with a single controlled argument. This can be exploited to escape the Vega...	Medium	CWE-79
dot-lens vulnerable to Prototype Pollution All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.	High	CWE-1321
Vega has Cross-site Scripting vulnerability in `lassoAppend` function - vega Vega’s lassoAppend function: lassoAppend accepts 3 arguments and internally invokes push function on the 1st argument specifying array consisting of 2nd and 3rd arguments as...	Medium	CWE-79
Vega has Cross-site Scripting vulnerability in `lassoAppend` function Vega’s lassoAppend function: lassoAppend accepts 3 arguments and internally invokes push function on the 1st argument specifying array consisting of 2nd and 3rd arguments as...	Medium	CWE-79
rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of...	Medium	CWE-79
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown.	Medium	CWE-696
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown.	Medium	CWE-696
Arbitrary local file read vulnerability during template rendering - swig-templates Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.	High	CWE-22
Arbitrary local file read vulnerability during template rendering Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.	High	CWE-22
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a...	High	CWE-538
Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown.	Medium	CWE-203
Content Injection via TileJSON Name in mapbox.js Versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 of mapbox.js are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.	Medium	CWE-79
Content Injection via TileJSON attribute in mapbox.js Versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 of mapbox.js are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.	Medium	CWE-79
matrix-js-sdk Prototype Pollution vulnerability Events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer’s ability to process...	High	CWE-1321
fastify/websocket vulnerable to uncaught exception via crash on malformed packet Any application using @fastify/websocket could crash if a specific, malformed packet is sent.	High	CWE-248
xmldom allows multiple root nodes in a DOM - xmldom xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the...	High	CWE-20
xmldom allows multiple root nodes in a DOM xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the...	High	CWE-20
CKEditor 4.0 vulnerability in the HTML Data Processor A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a...	Medium	CWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-g336-c7wv-8hp3 Affected versions of swagger-ui are vulnerable to cross-site scripting via the url query string parameter.	High	CWE-79
Cross-Site Scripting in @toast-ui/editor Versions of @toast-ui/editor prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS). There are multiple bypasses to the package’s built-in XSS sanitization. This may allow...	High	CWE-79
Cross-Site Scripting in bootstrap-vue Versions of bootstrap-vue prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the...	High	CWE-79
Content Injection in remarkable Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly whitelist link...	High	CWE-94
Cross-Site Scripting in webtorrent Versions of webtorrent prior to 0.107.6 are vulnerable to Cross-Site Scripting. webtorrent servers started with torrent.createServer() lists a torrent’s title and files in the index...	Medium	CWE-79
Cross-Site Scripting in c3 Affected versions of c3 are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips.	Medium	CWE-79
Reverse Tabnabbing in showdown Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the...	Low	CWE-1022
SvelteKit vulnerable to Cross-Site Request Forgery The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different...	High	CWE-352
phoenix_html allows Cross-site Scripting in HEEx class attributes tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes	Medium	CWE-79
Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter Cross-site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the editor parameter.	Medium	CWE-79
Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter Cross-site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the <iframe> src parameter....	Medium	CWE-79
Regular Expression Denial of Service in hawk Versions of hawk prior to 3.1.3, or 4.x prior to 4.1.1 are affected by a regular expression denial of service vulnerability related to excessively long...	High	CWE-1333
Regular Expression Denial of Service in highcharts - highcharts Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions....	High	CWE-1333
Denial of Service in protobufjs - protobufjs Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid *.proto files.	Medium	CWE-1333
Regular Expression Denial of Service in clean-css Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions....	Low	CWE-1333
Regular Expression Denial of Service in marked - marked - GHSA-ch52-vgq2-943f Affected versions of marked are vulnerable to Regular Expression Denial of Service (ReDoS). The _label subrule may significantly degrade parsing performance of malformed input.	Low	CWE-1333
Regular Expression Denial of Service in moment Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.	High	CWE-400
Denial of Service in axios Versions of axios prior to 0.18.1 are vulnerable to Denial of Service. If a request exceeds the maxContentLength property, the package prints an error but...	High	CWE-755
SvelteKit framework has Insufficient CSRF protection for CORS requests The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different...	High	CWE-918
Insecure Cryptography Algorithm in simple-crypto-js Versions of simple-crypto-js prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the...	Medium	CWE-327
Authentication Bypass in @strapi/plugin-users-permissions Strapi through 4.5.6 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for...	High
Improper Input Validation in sanitize-html Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by...	Medium	CWE-20
Out-of-bounds Read in base64url Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x...	Medium	CWE-125
Switcher Client contains Regular Expression Denial of Service (ReDoS) Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial...	High	CWE-400
matrix-js-sdk vulnerable to invisible eavesdropping in group calls An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk,...	Medium	CWE-862
Cross-Site Scripting in @ckeditor/ckeditor5-link Versions of status-board prior to 10.0.1 are vulnerable to Cross-Site Scripting. The _createPreviewButton() function fails to sanitize the href attribute of a created <a> tag....	Medium	CWE-79
Cross-site scripting vulnerability in TinyMCE - tinymce - GHSA-vrv8-v4w8-f95h A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content...	Medium	CWE-79
Cross-Site Scripting in react - react Affected versions of react are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers...	Medium	CWE-79
Prototype pollution in matrix-js-sdk (part 2) In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-js-sdk functionality, causing denial...	High	CWE-1321
Server side request forgery in SwaggerUI - swagger-ui-dist SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users...	Medium	CWE-918
Server side request forgery in SwaggerUI - swagger-ui-react SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users...	Medium	CWE-918
Server side request forgery in SwaggerUI SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users...	Medium	CWE-918
@claviska/jquery-minicolors vulnerable to Cross-site Scripting jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names....	Medium	CWE-79
Deserialization of Untrusted Data in bson - bson Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.	Medium	CWE-502
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.	High	CWE-918
Out-of-bounds Read in atob Versions of atob before 2.1.0 uninitialized Buffers when number is passed in input on Node.js 4.x and below.	High	CWE-125
Incorrect Authorization in @uppy/companion @uppy/companion prior to version 3.3.1 is vulnerable to incorrect authorization. A user with URL upload access could enumerate internal companion server networks, send local webservers...	High	CWE-918
Uncaught Exception in engine.io - engine.io A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.	High	CWE-755
Cross-site scripting vulnerability in TinyMCE - tinymce - GHSA-27gm-ghr9-4v95 A cross-site scripting (XSS) vulnerability was discovered in: the core parser, paste and visualchars plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially...	High	CWE-79
Leaking of user information on Cross-Domain communication in sysend Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted.This is not a big impact because it...	Medium	CWE-346
@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability Vendure provides an authorization system with different levels of privileges. For example, an administrator cannot create another administrator.	Medium	CWE-79
is_js vulnerable to Regular Expression Denial of Service is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service...	High	CWE-400
Cross-Site Scripting in jquery - jquery Affected versions of jquery are vulnerable to cross-site scripting. This occurs because the main jquery function uses a regular expression to differentiate between HTML and...	Medium	CWE-79
RCE in SiteServer CMS SiteServer CMS v7.x, which SiteServer UI relies on, allows attackers to execute arbitrary code via a crafted plug-in.	High
semver-regex Regular Expression Denial of Service (ReDOS) npm semver-regex is vulnerable to Inefficient Regular Expression Complexity	High	CWE-400
jquery-plugin-query-object contains prototype pollution vulnerability Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype.	High	CWE-1321
Kibana Sensitive Data Disclosure It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be...	Medium	CWE-319
eivindfjeldstad-dot contains prototype pollution vulnerability eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function ‘set’ could be tricked into adding or modifying properties of ‘Object.prototype’ using a ‘proto’ payload.	Medium	CWE-915
Validation bypass in frourio No description available.	High	CWE-20
Validation bypass in frourio-express No description available.	High	CWE-20
Malicious Package in radicjs Version 0.2.1 of radicjs contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in pm-controls Version 1.1.8 of pm-controls contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
xdlocalstorage does not verify request origin An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function...	High	CWE-668
Regular expression denial of service in semver-regex An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input...	Low	CWE-1333
Regular Expression Denial of Service (ReDoS) in jsx-slack jsx-slack v4.5.1 and earlier versions are vulnerable to a regular expression denial-of-service (ReDoS) attack.	Low	CWE-400
Possible inject arbitrary `CSS` into the generated graph affecting the container HTML An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the generated graph,...	Medium	CWE-79
JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-browser-runtime The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c (PBES2 Count), which determines how many PBKDF2 iterations must be executed in...	Medium	CWE-834
JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-cjs-runtime The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c (PBES2 Count), which determines how many PBKDF2 iterations must be executed in...	Medium	CWE-834
JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-esm-runtime The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c (PBES2 Count), which determines how many PBKDF2 iterations must be executed in...	Medium	CWE-834
JOSE vulnerable to resource exhaustion via specifically crafted JWE The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c (PBES2 Count), which determines how many PBKDF2 iterations must be executed in...	Medium	CWE-834
Potential exposure of tokens to an Unauthorized Actor When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit...	Medium	CWE-200
Uncontrolled Resource Consumption in markdown-it Special patterns with length > 50K chars can slow down parser significantly.	Medium	CWE-400
Denial of Service (DoS) vulnerability in RSSHub Passing some special values to the filter and filterout parameters can cause an abnormally high CPU. Impact on the performance of the servers and RSSHub...	Medium	CWE-400
Malicious Package in leaflet-gpx Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in coffee-project Version 1.7.5 of coffee-project contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High
Malicious Package in ember-power-timepicker Version 1.0.8 of ember-power-timepicker contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in geoheat Version 1.3.2 of geoheat contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in angular-location-update Version 0.0.3 of angular-location-update contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in libubx Version 1.0.3 of libubx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in jasmin Version 0.0.3 of jasmin contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High
Malicious Package in oauth-validator Version 1.0.2 of oauth-validator contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High
Malicious Package in react-dates-sc Version 0.3.0 of react-dates-sc contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High
Malicious Package in ngx-pica Version 1.1.5 of ngx-pica contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in github-jquery-widgets Version 0.1.2 of github-jquery-widgets contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in scroool Version 0.1.7 of scroool contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in precode.js Version 1.1.1 of precode.js contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in react-server-native Version 0.0.7 of react-server-native contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High
Malicious Package in mx-nested-menu Version 0.1.30 of mx-nested-menu contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Malicious Package in device-mqtt Version 1.0.11 of device-mqtt contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High
v8n vulnerable to Inefficient Regular Expression Complexity Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) +...	High	CWE-400
Malicious Package in radic-util Version 1.0.2 of radic-util contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...	High
Prototype Pollution in backbone-query-parameters Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.	High	CWE-1321
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal...	Medium	CWE-327
@excalidraw/excalidraw Cross-site Scripting vulnerability XSS vulnerability due to improperly sanitizing URLs of links that can be attached on canvas elements. This affects users of the npm package @excalidraw/excalidraw provided...	Medium	CWE-79
Prototype pollution in dotty Prototype pollution vulnerability in ‘dotty’ before version 0.1.1 allows attackers to cause a denial of service and may lead to remote code execution.	High	CWE-400
Prototype Pollution in lutils All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.	Medium	CWE-1321
Prototype pollution in nestie Prototype pollution vulnerability in ‘nestie’ versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution....	High	CWE-913
Regular Expression Denial of Service in browserslist The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.	Medium	CWE-400
steal vulnerable to Regular Expression Denial of Service via source and sourceWithComments A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal via the source and sourceWithComments variable in main.js.	High	CWE-1333
steal Inefficient Regular Expression Complexity vulnerability via string variable A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.	High	CWE-1333
Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory Angular Universal applications on 16.1.0 and 16.1.1 using critical CSS inlining are vulnerable to a cross-site scripting (XSS) attack where an attacker can trick another...	High	CWE-79
Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation - materialize-css In Materialize through 1.0.0, XSS is possible via the Toast feature.	Medium	CWE-79
Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation In Materialize through 1.0.0, XSS is possible via the Toast feature.	Medium	CWE-79
Materialize-css vulnerable to Cross-site Scripting in tooltip component - materialize-css All versions of materialize-css are vulnerable to Cross-Site Scripting. The tooltip component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript...	Medium	CWE-79
Materialize-css vulnerable to Cross-site Scripting in tooltip component All versions of materialize-css are vulnerable to Cross-Site Scripting. The tooltip component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript...	Medium	CWE-79
Materialize-css vulnerable to Cross-site Scripting in autocomplete component - materialize-css All versions of materialize-css are vulnerable to Cross-Site Scripting. The autocomplete component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript...	Medium	CWE-79
Materialize-css vulnerable to Cross-site Scripting in autocomplete component All versions of materialize-css are vulnerable to Cross-Site Scripting. The autocomplete component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript...	Medium	CWE-79
dijit editor cross-site scripting vulnerability dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.	Medium	CWE-79
Regular Expression Denial of Service in jquery-validation The GitHub Security Lab team has identified potential security vulnerabilities in jquery.validation.	High	CWE-400
Prototype Pollution in js-data All versions of package js-data prior to 3.0.10 are vulnerable to Prototype Pollution via the deepFillIn function.	High	CWE-1321
Prototype pollution in @tsed/core This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on...	Medium	CWE-915
Cross-site Scripting in markdown-it-highlightjs This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature....	Medium	CWE-79
Prototype Pollution in decal This affects all versions of package decal. The vulnerability is in the extend function.	High	CWE-94
Denial of service in prismjs The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.	High	CWE-400
js-bson vulnerable to REDoS The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS)...	High	CWE-400
Inefficient Regular Expression Complexity in handsontable The package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.	High	CWE-1333
rendertron can remotely shut down Chrome instance Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET...	High	CWE-284
dalek-browser-chrome Downloads Resources over HTTP Affected versions of dalek-browser-chrome insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
rendertron LFI vulnerability Rendertron 1.0.0 allows for alternative protocols such as ‘file://’ introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote...	High	CWE-22
rendertron XSS vulnerability Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.	Medium	CWE-79
ReDoS via long UserAgent header in useragent Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed.	High	CWE-400
Invalid Curve Attack in node-jose Affected versions of node-jose are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key...	Medium	CWE-200
Elliptic Uses a Broken or Risky Cryptographic Algorithm The npm package elliptic before version 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that...	Medium	CWE-327
Rendertron discloses absolute paths of files Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the “_where” attribute of...	High	CWE-200
SimpleMDE XSS Vulnerability SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled...	Medium	CWE-79
Svelte vulnerable to XSS when using objects during server-side rendering The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects...	Medium	CWE-79
Valine HTML Injection An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with...	Medium	CWE-79
Directory Traversal in commentapp.stetsonwood Affected versions of commentapp.stetsonwood resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside...	High	CWE-22
opencv.js is malware opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.	High	CWE-506
Command injection in github-todos naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by...	High	CWE-78
steal vulnerable to Regular Expression Denial of Service via input variable A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal via the input variable in main.js.	High	CWE-1333
dalek-browser-ie downloads Resources over HTTP Affected versions of dalek-browser-ie insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
URIjs Vulnerable to Hostname spoofing via backslashes in URL If using affected versions to determine a URL’s hostname, the hostname can be spoofed by using a combination of backslash (\) and slash (/) characters...	Medium	CWE-601
Template Injection in jsrender Affected versions of jsrender are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.	Medium	CWE-94
Regular Expression Denial of Service in marked - marked Affected versions of marked are vulnerable to a regular expression denial of service.	High	CWE-400
Sanitization bypass using HTML Entities in marked Affected versions of marked are susceptible to a cross-site scripting vulnerability in link components when sanitize:true is configured.	Medium	CWE-79
Prototype Pollution in deephas Prototype pollution vulnerability in ‘deephas’ versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.	High	CWE-915
openssl.js is malware The openssl.js package is a piece of malware that steals environment variables and sends them to attacker controlled locations.	High	CWE-506
Insecure Defaults Allow MITM Over TLS in engine.io-client Affected versions of engine.io-client do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks.	Medium	CWE-300
Marked vulnerable to XSS from data URIs marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.	Medium	CWE-79
Cross-site scripting in jspdf - jspdf Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It’s possible to inject JavaScript code via the html method.	Medium	CWE-79
Cross-site scripting in jspdf It’s possible to use nested script tags in order to bypass the filtering regex.	Medium	CWE-79
Regular Expression Denial of Service in content Affected versions of content are vulnerable to a regular expression denial of service when parsing malicious Content-Type and Content-Disposition headers.	High	CWE-400
Cross-site Scripting in remarkable In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.	Medium	CWE-79
Code injection in mock2easy This affects all versions up to and including version 0.0.24 of package mock2easy. a malicious user could inject commands through the _data variable:	High	CWE-77
Regular Expression Denial of Service in postcss The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in...	Medium	CWE-400
Pandao editor.md vulnerable to DOM XSS pandao Editor.md 1.5.0 has DOM XSS via input starting with a << substring, which is mishandled during construction of an A element.	Medium	CWE-79
XSS in Data URI in remarkable Affected versions of remarkable are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of data: URIs in links, and can therefore...	High	CWE-79
Regular Expression Denial of Service in decamelize Affected versions of decamelize are susceptible to a denial of service vulnerability when user input is passed directly into decamelize.	High	CWE-400
Pandao editor.md vulnerable to XSS in IMG attributes Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.	Medium	CWE-79
jspdf vulnerable to Regular Expression Denial of Service (ReDoS) This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.	High	CWE-400
netmask npm package mishandles octal input data The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in...	Medium	CWE-20
ejs is vulnerable to remote code execution due to weak input validation nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function	High	CWE-20
Cryptographically Weak PRNG in randomatic Affected versions of randomatic generate random values using a cryptographically weak psuedo-random number generator. This may result in predictable values instead of random values as...	Medium	CWE-338
ejs vulnerable to DoS due to weak input validation nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()	High	CWE-20
Prototype Pollution in sey All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.	Medium	CWE-1321
node-browser downloads Resources over HTTP Affected versions of node-browser insecurely downloads resources over HTTP.	High	CWE-311
mde ejs vulnerable to XSS nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection	Medium	CWE-79
Prototype Pollution in field Prototype pollution vulnerability in ‘field’ versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.	High	CWE-915
Cross-Site Scripting in sanitize-html - sanitize-html Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag.	Medium	CWE-79
Cross-Site Scripting in sanitize-html Affected versions of sanitize-html are vulnerable to cross-site scripting.	Medium	CWE-79
superagent vulnerable to zip bomb attacks Affected versions of superagent do not check the post-decompression size of ZIP compressed HTTP responses prior to decompressing. This results in the package being vulnerable...	Medium	CWE-409
Cross-Site Scripting in i18next - i18next Affected versions of i18next may fail to sanitize user input when certain configuration options are used. When using the .init method, passing interpolation options without...	Medium	CWE-79
Cross-Site Scripting in i18next Affected versions of i18next allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.	Medium	CWE-79
Macro in MathJax running untrusted Javascript within a web browser MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running...	Medium	CWE-79
Insecure template handling in Squirrelly Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options...	High	CWE-200
Denial of service in three This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors.	High	CWE-400
selenium-chromedriver Downloads Resources over HTTP Affected versions of selenium-chromedriver insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
auth0-lock vulnerable to XSS via unsanitized placeholder property Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the additionalSignUpFields customization option to add a checkbox to...	Medium	CWE-79
pym.js CSRF Vulnerability NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross Site Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function.	High	CWE-352
d3.js is malware The d3.js package is a piece of malware that steals environment variables and sends them to attacker controlled locations.	High	CWE-506
dalek-browser-ie-canary downloads Resources over HTTP Affected versions of dalek-browser-ie-canary insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
Path Traversal in localhost-now All versions of localhost-now are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served...	High	CWE-22
Prototype Pollution in record-like-deep-assign All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.	High	CWE-915
RSA signature validation vulnerability on maleable encoded message in jsrsasign Vulnerable jsrsasign will accept RSA signature with improper PKCS#1.5 padding.Decoded RSA signature value consists following form:01(ff...(8 or more ffs)...ff)00[ASN.1 OF DigestInfo]Its byte length must be...	High	CWE-347
Sensitive data exposure in NATS - nats Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server;...	High	CWE-522
Sensitive data exposure in NATS Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server;...	High	CWE-522
Regular Expression Denial of Service in no-case Affected versions of no-case are vulnerable to a regular expression denial of service when parsing untrusted user input.	High	CWE-400
bracket-template vulnerable to reflected XSS bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template	Medium	CWE-79
Regular Expression Denial of Service in jadedown The jadedown package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in.	Low	CWE-400
Cross-site Scripting in React Draft Wysiwyg react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is...	Medium	CWE-79
cloudpub-redis downloads Resources over HTTP Affected versions of cloudpub-redis insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
CORS misconfiguration in socket.io The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.	Medium	CWE-453
Code Injection in jsen This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine....	High	CWE-94
Regular Expression Denial of Service in djvalidator All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@------------------------------------------------------------------------------------------------------------------------!.	High	CWE-400
Directory Traversal in rtcmulticonnection-client Affected versions of rtcmulticonnection-client resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside...	High	CWE-22
Directory Traversal in cyber-js Affected versions of cyber-js resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside...	High	CWE-22
Directory Traversal in xtalk Affected versions of xtalk are vulnerable to directory traversal, allowing access to the filesystem by placing “../” in the URL.	High	CWE-22
XSS in hello.js This affects the package hello.js before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation....	High	CWE-79
Credential leak in react-native-fast-image This affects all versions before version 8.3.0 of package react-native-fast-image. When an image with source= is loaded, all other subsequent images will use the same...	Medium	CWE-200
Remote Code Execution in scratch-vm MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the...	High	CWE-502
mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input Affected versions of mime are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.	High	CWE-400
selenium-wrapper downloads Resources over HTTP Affected versions of selenium-wrapper insecurely download an executable over an unencrypted HTTP connection.	High	CWE-311
Code Injection in cryo All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization.	High	CWE-94
Arbitrary Code Execution in mathjs math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.	High	CWE-88
Regular Expression Denial of Service in riot-compiler Affected versions of riot-compiler are susceptible to a regular expression denial of service vulnerability.	High	CWE-400
mcstatic directory traversal vulnerability A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system...	High	CWE-22
Bypassing Sanitization using DOM clobbering in html-janitor All versions of html-janitor are vulnerable to cross-site scripting (XSS).	Medium	CWE-642
html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - html-parse-stringify This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used...	Medium	CWE-400
html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used...	Medium	CWE-400
XSS in apexcharts The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.	Medium	CWE-79
Prototype pollution in gsap There is a prototype pollution vulnerability in gsap which affects all versions before 3.6.0.	High	CWE-400
Cross-Site Scripting in html-janitor Versions of html-janitor prior to 2.0.2 (all current versions) are vulnerable to cross-site scripting (XSS).	Medium	CWE-79
Directory Traversal in fbr-client Affected versions of fbr-client resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside...	High	CWE-22
Server-Side Request Forgery in @uppy/companion The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local...	High	CWE-918
Regular Expression Denial of Service in timespan Affected versions of timespan are vulnerable to a regular expression denial of service when parsing dates.	High	CWE-400
Electron vulnerable to URL spoofing via PDFium Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can...	Medium	CWE-345
Docsify XSS Vulnerability This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods...	Medium	CWE-79
auth0-js Privilege Escalation Vulnerability A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users’ tokens...	High	CWE-200
tiny-json-http missing SSL certificate validation brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected....	High	CWE-295
DataTable Vulnerable to Cross-Site Scripting Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the...	High	CWE-79
Directory Traversal in datachannel-client Affected versions of datachannel-client resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside...	High	CWE-22
Prototype Pollution in asciitable.js The package asciitable.js before 1.0.3 is vulnerable to Prototype Pollution via the main function.	High	CWE-400
Cross-site Scripting in epubjs managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.	Medium	CWE-79
jszip Vulnerable to Prototype Pollution This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in...	Medium	CWE-1321
Regular Expression Denial of Service (ReDoS) - ssri npm ssri 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely...	High	CWE-400
Regular Expression Denial of Service (ReDoS) The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker...	High	CWE-400
Inefficient Regular Expression Complexity in chalk/ansi-regex ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.	High	CWE-697
decode-uri-component vulnerable to Denial of Service (DoS) decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.	High	CWE-20
Cross-Site Scripting (XSS) in jquery Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn’t contain...	Medium	CWE-79
hexo-admin plugin for Node.js XSS Vulnerability The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post....	Medium	CWE-79
Cezerin Unauthorized Acces Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer...	High	CWE-20
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in...	Medium	CWE-79
XSS in `Text` options of the Datepicker widget in jquery-ui Accepting the value of various Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the...	Medium	CWE-79
bson-objectid contains Improper input validation An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting...	High	CWE-670
XSS in the `altField` option of the Datepicker widget in jquery-ui Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the...	Medium	CWE-79
dojox vulnerable to unescaped string injection In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid.	High	CWE-116
Cross-Site Scripting in dojo Affected versions of dojo are susceptible to a cross-site scripting vulnerability in the dijit.Editor and textarea components, which execute their contents as Javascript, even when...	Medium	CWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-4f9m-pxwh-68hg Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which...	Medium	CWE-79
Cross-Site Scripting in diagram-js Versions of diagram-js prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled...	Medium	CWE-79
Etherpad Lite Access Restriction Bypass node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.	High	CWE-20
Angular Redactor XSS Vulnerability Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG...	Medium	CWE-79
Converse.js Exposure of Sensitive Information Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data...	Medium	CWE-200
Simditor XSS Vulnerability Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.	Medium	CWE-79
Cross-Site Scripting in swagger-ui - swagger-ui Affected versions of swagger-ui are vulnerable to cross-site scripting. This vulnerability exists because swagger-ui automatically executes external Javascript that is loaded in via the url...	High	CWE-79
Cisco node-jose improper validation of JWT signature A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is...	High	CWE-347
Auth0 angular-jwt misinterprets allowlist as regex Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain allowlist...	Medium	CWE-20
keyget vulnerable to prototype pollution Prototype pollution vulnerability in ‘keyget’ versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.	High	CWE-1321
Grunt-karma vulnerable to prototype pollution Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.	High	CWE-1321
Xen Orchestra Mishandles Authorization Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the...	Medium	CWE-863
Docsify vulnerable to cross-site scripting due to mishandled encoding docsify versions 4.12.1 and earlier are vulnerable to cross-site scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the "...	Medium	CWE-79
mxGraph vulnerable to cross-site scripting in color field mxGraph through 4.0.0, related to the draw.io Diagrams plugin before 8.3.14 for Confluence and other products, is vulnerable to cross-site scripting. draw.io Diagrams allows the...	Medium	CWE-79
MJML vulnerable to path traversal MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.	High	CWE-22
mxGraph vulnerable to cross-site scripting in setTooltips function mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.	Medium	CWE-79
mxGraph vulnerable to XXE attacks In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView....	High	CWE-611
rgb2hex vulnerable to inefficient regular expression complexity A vulnerability was found in rgb2hex up to 0.1.5. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to...	High	CWE-1333
skeemas Inefficient Regular Expression Complexity vulnerability A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the...	High	CWE-1333
is-url Inefficient Regular Expression Complexity vulnerability A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is an unknown functionality of...	High	CWE-1333
debug Inefficient Regular Expression Complexity vulnerability A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation...	High	CWE-1333
Cross-realm object access in Webpack 5 Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted...	High
EpicEditor XSS Vulnerability EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML...	Medium	CWE-79
Prototype Pollution leading to Remote Code Execution in superjson This is critical vulnerability, as it allows to run arbitrary code on any server using superjson input, including a Blitz.js server, without prior authentication or...	High	CWE-94
Improper Input Validation in vriteio/vrite Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0.	Medium	CWE-20
Server-Side Request Forgery (SSRF) in vriteio/vrite Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0.	High	CWE-918
webmention.js Cross-site Scripting vulnerability webmention.js prior to 0.5.5 is vulnerable to cross-site scripting.	High	CWE-79
Leaking sensitive user information still possible by filtering on private with prefix fields Still able to leak private fields if using the t(number) prefix	High	CWE-200
progressbar.js vulnerable to Prototype Pollution All versions of the package progressbar.js prior to 1.1.1 are vulnerable to Prototype Pollution via the function extend() in the file utils.js.	High	CWE-1321
Jodit Editor vulnerable to cross-site scripting Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component.	Medium	CWE-79
Path traversal vulnerability in gatsby-plugin-sharp The gatsby-plugin-sharp plugin prior to versions 5.8.1 and 4.25.1 contains a path traversal vulnerability exposed when running the Gatsby develop server (gatsby develop).	Medium	CWE-22
Making all attributes on a content-type public without noticing it - @strapi/utils Anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it.	Medium	CWE-200
Making all attributes on a content-type public without noticing it Anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it.	Medium	CWE-200
layui vulnerable to cross-site scripting A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler....	Medium	CWE-79
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix	High	CWE-79
@builder.io/qwik-city Cross-Site Request Forgery vulnerability Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.	Medium	CWE-352
Cleartext Signed Message Signature Spoofing in openpgp OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools:	Medium	CWE-347
Chaijs/get-func-name vulnerable to ReDoS The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks.	High	CWE-400
tarteaucitron.js vulnerable to Cross-site Scripting Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.	Medium	CWE-79
Cross-Site Scripting in serialize-to-js Versions of serialize-to-js prior to 3.0.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect...	Low	CWE-79
Unauthorized Access to Private Fields in User Registration API - @strapi/plugin-users-permissions \| Name \| Value \|\|———-\|————————\|\| OS \| Windows 11 \|\| Version \| 4.11.1 (node v16.14.2) \|\| Database \| mysql \|	High	CWE-287
Unauthorized Access to Private Fields in User Registration API \| Name \| Value \|\|———-\|————————\|\| OS \| Windows 11 \|\| Version \| 4.11.1 (node v16.14.2) \|\| Database \| mysql \|	High	CWE-287
TinyMCE XSS vulnerability in notificationManager.open API A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE’s unfiltered notification system, which is used in error handling....	Medium	CWE-79
antfu/utils vulnerable to prototype pollution Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.	Medium	CWE-1321
Feathers socket handler allows abusing implicit toString - @feathersjs/socketio Feathers socket handler did not catch invalid string conversion errors like:	High	CWE-754
Feathers socket handler allows abusing implicit toString Feathers socket handler did not catch invalid string conversion errors like:	High	CWE-754
editor.md vulnerable to Cross-site Scripting Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted markdown text.	Medium	CWE-79
Strapi leaking sensitive user information by filtering on private fields Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users.	High	CWE-312
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server.	High	CWE-74
Cloudera HUE Account Enumeration Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.	Medium	CWE-200
external-svg-loader Cross-site Scripting vulnerability According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not...	High	CWE-79
Allocation of Resources Without Limits or Throttling in vriteio/vrite Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.	Medium	CWE-770
html inputs of type password recorded in plaintext when converted to text inputs Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript “Show Password” button. This differs from...	Medium	CWE-319
Svelecte item names vulnerable to execution of arbitrary JavaScript Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be...	Medium	CWE-79
Strapi does not verify the access or ID tokens issued during the OAuth flow Strapi 3.2.1 until 4.6.0 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used...	Medium
ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode.	Medium	CWE-79
When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id If you used the apiPrefilter option of the @Entity decorator, by setting it to a function that returns a filter that prevents unauthorized access to...	Medium	CWE-284
jquery-ui Tooltip widget vulnerable to XSS Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject...	Medium	CWE-79
MrSwitch hello.js vulnerable to prototype pollution A prototype pollution vulnerability in MrSwitch hello.js prior to version 1.18.8 allows remote attackers to execute arbitrary code via hello.utils.extend function.	High	CWE-1321
Uncaught Exception in yaml Uncaught Exception in GitHub repository eemeli/yaml starting at version 2.0.0-5 and prior to 2.2.2.	High	CWE-248
Joplin Cross-site Scripting vulnerability - joplin Joplin before 2.11.5 allows XSS via a USE element in an SVG document.	Medium	CWE-79
Joplin Cross-site Scripting vulnerability Joplin before 2.11.5 allows XSS via an AREA element of an image map.	Medium	CWE-79
@udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links...	High	CWE-79
Cross-Site Scripting in highcharts Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize href values and does not restrict...	High	CWE-79
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.	High	CWE-94
Strapi Improper Rate Limiting vulnerability - @strapi/plugin-users-permissions There is a rate limit on the login function of Strapi’s admin screen, but it is possible to circumvent it.	High	CWE-770
Strapi Improper Rate Limiting vulnerability There is a rate limit on the login function of Strapi’s admin screen, but it is possible to circumvent it.	High	CWE-770
Strapi may leak sensitive user information, user reset password, tokens via content-manager views - @strapi/utils I can get access to user reset password tokens if I have the configure view permissions	Medium	CWE-200
Strapi may leak sensitive user information, user reset password, tokens via content-manager views I can get access to user reset password tokens if I have the configure view permissions	Medium	CWE-200
`chainId` may be outdated if user changes chains as part of connection in @web3-react - @web3-react/coinbase-wallet chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React()...	Medium	CWE-362
`chainId` may be outdated if user changes chains as part of connection in @web3-react - @web3-react/eip1193 chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React()...	Medium	CWE-362
`chainId` may be outdated if user changes chains as part of connection in @web3-react - @web3-react/metamask chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React()...	Medium	CWE-362
`chainId` may be outdated if user changes chains as part of connection in @web3-react chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React()...	Medium	CWE-362
angular-ui-notification Cross-site Scripting vulnerability angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.	Medium	CWE-79
Hidden fields can be leaked on readable collections in Payload If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values...	High	CWE-200
Use-After-Free in puppeteer Versions of puppeteer prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may...	Medium	CWE-416
Prototype Pollution in NASA Open MCT In NASA Open MCT (aka openmct) before commit 545a177 is subject to a prototype pollution which can occur via an import action.	High	CWE-1321
Gatsby develop server has Local File Inclusion vulnerability The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the __file-code-frame and __original-stack-frame paths, exposed when running the...	Medium	CWE-22
Margox Braft-Editor Cross-site Scripting Vulnerability Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embed media feature.	Medium	CWE-79
Potential for cross-site scripting in PostHog-js Potential for cross-site scripting in posthog-js.	Medium	CWE-79
matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms It was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing...	Low	CWE-200
graphql Uncontrolled Resource Consumption vulnerability Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file...	Medium	CWE-400
@nuxtlabs/github-module made Use of Hard-coded Credentials https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes...	High	CWE-798
Bootbox.js Cross Site Scripting vulnerability Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), confirm(),...	Medium	CWE-79
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer,...	Medium	CWE-79
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not...	Medium	CWE-79
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user.	Medium	CWE-918
chromedriver Command Injection vulnerability Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to...	Medium	CWE-78
NASA Open MCT Cross Site Scripting vulnerability Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in...	Medium	CWE-79
NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.	Medium	CWE-352
Uncontrolled Resource Consumption in strapi A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary...	Medium	CWE-400
google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability A Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An attacker can...	Low	CWE-918
Exposure of Sensitive Information in eventsource When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application....	High	CWE-212
uri-template-lite Regular Expression Denial of Service An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input...	Medium	CWE-697
Collection.js vulnerable to Prototype Pollution Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.	High	CWE-1321
Regular expression denial of service in devcert An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input...	High	CWE-1333
dottie vulnerable to Prototype Pollution Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in...	High	CWE-1321
fast-xml-parser regex vulnerability patch could be improved from a safety perspective This is a comment on https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw and the patches fixing it.	Low
Regular Expression Denial of Service in Handlebars Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing...	High	CWE-400
Prototype Pollution in handlebars - handlebars - GHSA-q42p-pg8m-cqh6 Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects’ prototype, thus allowing an attacker to execute arbitrary code...	High	CWE-471
Arbitrary Code Execution in Handlebars - handlebars Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit...	High	CWE-94
Remote code execution in handlebars when compiling templates The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source....	High	CWE-94
Uncontrolled Resource Consumption in Hawk Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP...	High	CWE-400
Validation Bypass in kind-of Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check,...	High	CWE-668
Inefficient Regular Expression Complexity in marked - marked Denial of service.	High	CWE-1333
Inefficient Regular Expression Complexity in marked Denial of service.	High	CWE-400
ReDoS in normalize-url The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it...	High	CWE-400
Inefficient Regular Expression Complexity in nth-check There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.	High	CWE-1333
Prototype pollution in Plist before 3.0.5 can cause denial of service Prototype pollution vulnerability via .parse() in Plist allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.	High	CWE-1321
Prototype Pollution in protobufjs The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until...	High	CWE-1321
Prototype Pollution in querystringify A vulnerability was found in querystringify before 2.0.0. It’s possible to override built-in properties of the resulting query string object if a malicious string is...	High	CWE-1321
Code Execution Through IIFE in serialize-to-js Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE).	High	CWE-502
Insecure serialization leading to RCE in serialize-javascript serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function “deleteFunctions” within “index.js”.	High	CWE-502
Uncontrolled Resource Consumption in trim-newlines @rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for...	High	CWE-400
underscore-keypath vulnerable to Prototype Pollution Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible...	High	CWE-1321
Incorrect protocol extraction via \r, \n and \t characters \r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.	High	CWE-20
Authorization Bypass Through User-Controlled Key in url-parse url-parse prior to version 1.5.8 is vulnerable to Authorization Bypass Through User-Controlled Key.	High	CWE-639
Prototype Pollution in vConsole vConsole was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.	High	CWE-1321
Inefficient Regular Expression Complexity in validator.js validator.js prior to 13.7.0 is vulnerable to Inefficient Regular Expression Complexity	Medium	CWE-1333
Improper Certificate Validation in xmlhttprequest-ssl The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to...	High	CWE-295
xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection - xmlhttprequest This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into...	High	CWE-94
xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into...	High	CWE-94
Malicious Package in another-date-picker Version 2.0.43 of another-date-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High	CWE-506
Denial of Service in markdown-it-toc-and-anchor All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing text+\n@[toc] causes the application to enter and infinite loop.	High	CWE-400
Improper Key Verification in ipns Versions 0.1.1 or 0.1.2 of ipns are vulnerable to improper key validation. This is due to the public key verification was not being performed properly,...	High	CWE-287
Malicious Package in another-date-range-picker Version 4.1.48 of another-date-range-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...	High	CWE-506
Denial of Service in ipfs-bitswap Versions of ipfs-bitswap prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used...	Medium	CWE-400
URIjs Hostname spoofing via backslashes in URL If using affected versions to determine a URL’s hostname, the hostname can be spoofed by using a backslash (\) character as part of the scheme...	High	CWE-20
SSRF & Credentials Leak nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL...	High	CWE-918
Directory Traversal in evershop - @evershop/evershop - GHSA-4wrm-qmq2-5fjx Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync function...	Medium	CWE-22
Cross-site Scripting in evershop - @evershop/evershop - GHSA-2xcj-557c-hf8r Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy...	Medium	CWE-79
Cross Site Scripting in evershop - @evershop/evershop Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid...	Medium	CWE-79
Directory Traversal in evershop - @evershop/evershop Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function...	High	CWE-22
Directory Traversal in evershop Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function...	Medium	CWE-22
Cross-site Scripting in evershop Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin...	Medium	CWE-79
Code execution in evershop An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file.	High
DOS by abusing `fetchOptions.retry`. nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. ofetch is used to send the requests.	High	CWE-787
Buttercup allows attackers to obtain the hash of the master password Buttercup allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/.	Medium	CWE-916
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.	Medium	CWE-1321
Cross-site Scripting in @spscommerce/ds-react XSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been...	High	CWE-79
mockjs vulnerable to Prototype Pollution via the Util.extend function All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the...	High	CWE-1321
Cube API denial of service attack It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.	Medium	CWE-20
Cross-site Scripting in cesium A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim’s browser via sending a crafted...	Medium	CWE-79
HTML comments vulnerability allowing to execute JavaScript code The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.	High	CWE-79
Sentry's Astro SDK vulnerable to ReDoS A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry’s Astro SDK 7.78.0-7.86.0. Under certain conditions, this vulnerability allows an attacker to...	High	CWE-400
bsock uses weak hashing algorithms An issue was discovered in the bsock component of bcoin-org bcoin that allows remote attackers to obtain sensitive information via weak hashing algorithms in the...	High	CWE-327
Cross-site scripting vulnerability in TinyMCE - tinymce A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a...	Medium	CWE-79
Cross-site scripting vulnerability in TinyMCE plugins A cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the image and link plugins. The vulnerability allowed arbitrary JavaScript execution when...	Medium	CWE-79
Cross-site scripting vulnerability in TinyMCE A cross-site scripting (XSS) vulnerability was discovered in the schema validation logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a...	Medium	CWE-79
Layui cross-site scripting (XSS) vulnerability layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.	Medium	CWE-79
msgpackr's conversion of property names to strings can trigger infinite recursion When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop.	High	CWE-674
botframework-connector vulnerable to Improper Authentication A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability...	Medium	CWE-287
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router.	High	CWE-639
react-native-mmkv Insertion of Sensitive Information into Log File vulnerability Before version v2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by...	Medium	CWE-532
QooxDoo XSS in Callback Parameter Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows...	Medium	CWE-79
Incorrect Default Permissions in log4js Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files...	Medium	CWE-276
Sending a GET or HEAD request with a body crashes SvelteKit In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD...	High	CWE-20
npm package rfc6902 vulnerable to Prototype Pollution A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly...	High	CWE-74
@urql/next Cross-site Scripting vulnerability The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the...	High	CWE-79
@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering...	High	CWE-80
react-query-streamed-hydration Cross-site Scripting vulnerability The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange...	High	CWE-79
MathJax Regular expression Denial of Service (ReDoS) Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE:...	High	CWE-1333
@lobehub/chat vulnerable to unauthorized access to plugins When the application is password-protected (deployed with the ACCESS_CODE option), it is possible to access plugins without proper authorization (without password).	Medium	CWE-284
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard No description available.	High	CWE-916
shvl vulnerable to prototype pollution Prototype pollution vulnerability in ‘shvl’ versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution....	High	CWE-1321
dset vulnerable to prototype pollution Prototype pollution vulnerability in ‘dset’ versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.	High	CWE-1321
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS) The Enhanced Image (aka image2) plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and...	Medium	CWE-79
Ckeditor XSS Vulnerability CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.	Medium	CWE-79
Arbitrary Code Execution in handlebars Versions of handlebars prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package’s lookup helper fails to properly validate templates, allowing attackers...	High	CWE-94
CKEditor cross-site scripting vulnerability in AJAX sample The vulnerability has been discovered in the AJAX sample available at the samples/old/ajax.html file location. All integrators that use that sample in the production code...	Medium	CWE-79
ckeditor4 vulnerable to cross-site scripting A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript...	Medium	CWE-79
Regular Expression Denial of Service in marked Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the...	High	CWE-1333
Luxon Inefficient Regular Expression Complexity vulnerability Luxon’s DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted...	High	CWE-1333
Stimulsoft Dashboard.JS directory traversal vulnerability Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName...	High	CWE-22
Stimulsoft Dashboard.JS Cross Site Scripting vulnerability Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the...	Medium	CWE-79
Default swagger-ui configuration exposes all files in the module The default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module’s directory being exposed via http routes served by the...	Medium	CWE-1188
GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219` The GitHub Security Lab team has identified potential security vulnerabilities in scrypted.	High
Prototype Pollution in JSON5 via Parse Method The parse method of the JSON5 library before and including version 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to...	High	CWE-1321
Misinterpretation of malicious XML input - xmldom xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes...	Medium	CWE-116
Misinterpretation of malicious XML input xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes...	Medium	CWE-116
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.	High	CWE-203
Starcounter-Jack JSON-Patch Prototype Pollution vulnerability A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly...	High	CWE-1321
CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature The vulnerability has been discovered in the samples that use the preview feature:	Medium	CWE-79
Stimulsoft Dashboard.JS Cross Site Scripting vulnerability - stimulsoft-dashboards-js Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the...	Medium	CWE-79
CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection The vulnerability has been discovered in the core HTML parsing module and may affect all editor instances that: Enabled full-page editing mode, or enabled CDATA...	Medium	CWE-79
JSONata expression can pollute the "Object" prototype In JSONata versions >= 1.4.0, < 1.8.7 and >= 2.0.0, < 2.0.4, a malicious expression can use the transform operator to override properties on the...	High	CWE-1321
TurboBoost Commands vulnerable to arbitrary method invocation TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren’t as...	High	CWE-74
Strapi 4.1.12 Cross-site Scripting via crafted file An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After...	Medium	CWE-79
RSSHub Cross-site Scripting vulnerability caused by internal media proxy When the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of...	Medium	CWE-79
RSSHub vulnerable to Server-Side Request Forgery Serveral Server-Side Request Forgery (SSRF) vulnerabilities in RSSHub allow remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary...	Medium	CWE-918
SQL injection in typeORM The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a...	High	CWE-89
Path traversal in webpack-dev-middleware No description available.	High	CWE-22
Cache Poisoning Vulnerability An attacker controlling the second variable of the translate function is able to perform a cache poisoning attack. They can change the outcome of translation...	Medium	CWE-20
Regular Expression Denial of Service in debug Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.	Low	CWE-400
KaTeX's maxExpand bypassed by Unicode sub/superscripts KaTeX users who render untrusted mathematical expressions could encounter malicious input using \def or \newcommand that causes a near-infinite loop, despite setting maxExpand to avoid...	Medium	CWE-674
KaTeX's `\includegraphics` does not escape filename KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML.	Medium	CWE-116
KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols Code that uses KaTeX’s trust option, specifically that provides a function to block-list certain URL protocols, can be fooled by URLs in malicious inputs that...	Medium	CWE-184
OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation A security vulnerability exists in oneuptime’s local storage handling, where a regular user can escalate privileges by modifying the is_master_admin key to true. This allows...	High	CWE-639
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or...	Medium	CWE-79
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor.	Medium	CWE-79
@workos-inc/authkit-nextjs session replay vulnerability A user can reuse an expired session by controlling the x-workos-session header.	Medium	CWE-294
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - jose-node-cjs-runtime A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. This...	Medium	CWE-400
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - jose-node-esm-runtime A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. This...	Medium	CWE-400
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. This...	Medium	CWE-400
Formstone Vulnerable to Reflected XSS Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files....	Medium	CWE-79
MooTools Regular Expression Denial of Service MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expression Denial...	High	CWE-400
jplayer Cross Site Scripting vulnerability Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.	Medium	CWE-79
jQuery-Upload-File XSS in fileNameStr A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file...	Medium	CWE-79
json-pointer vulnerable to Prototype Pollution A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the...	High	CWE-1321
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code Using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely...	High	CWE-697
dectalk-tts Uses Unencrypted HTTP Request In [email protected], network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers....	High	CWE-598
React Native Sms User Consent Intent Redirection Vulnerability A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function...	Medium	CWE-926
Summernote vulnerable to cross-site scripting Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview parameter....	Medium	CWE-79
Matrix IRC Bridge truncated content of messages can be leaked The matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to...	Medium	CWE-280
Handling untrusted input can result in a crash, leading to loss of availability / denial of service Using particular inputs with @solana/web3.js will result in memory exhaustion (OOM).	High	CWE-119
Prototype pollution in emit function A prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key....	Low	CWE-1321
Stored Cross-site Scripting (XSS) in excalidraw's web embed component A stored XSS vulnerability in Excalidraw’s web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor...	Medium	CWE-79
zcap has incomplete expiration checks in capability chains. When invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the expires property is not properly...	Medium	CWE-613
Insufficient validation when decoding a Socket.IO packet - socket.io-parser Due to improper type validation in the socket.io-parser library (which is used by the socket.io and socket.io-client packages to encode and decode Socket.IO packets), it...	High	CWE-89
Regular Expression Denial Of Service in uri-js Affected versions of uri-js is susceptible to a regular expression denial of service vulnerability when user input is sent to the .parse() method.	Medium	CWE-400
Regular Expression Denial of Service in remarkable lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.	High	CWE-400
jqueryFileTree vulnerable to Directory Traversal jqueryFileTree 2.1.5 and older is vulnerable to Directory Traversal	High	CWE-22
Prototype pollution vulnerability in 'deep-set The NPM module ‘deep-set’ can be abused by Prototype Pollution vulnerability since the function deepSet() does not check for the type of object before assigning...	High	CWE-1321
CKEditor 4 ReDoS Vulnerability It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input...	Medium	CWE-1333
mootools-more vulnerable to prototype pollution Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype.	High	CWE-1321
Sanitize-html Vulnerable To REDoS Attacks The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment...	High	CWE-1333
deep-defaults vulnerable to prototype pollution Prototype pollution vulnerability in ‘deep-defaults’ versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.	High	CWE-1321
Joplin vulnerable to Cross-site Scripting in notes Joplin before 2.0.9 allows Cross-site Scripting via button and form in the note body.	Medium	CWE-79
Joplin Vulnerable to Code Injection Joplin prior to version 2.7.1 allows remote attackers to execute system commands through malicious code in user search results.	High	CWE-94
Joplin Vulnerable to Cross-site Scripting in Note Content Joplin version prior to 1.0.90 contains a Cross-site Scripting (XSS) evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS...	Medium	CWE-79
Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.	Medium	CWE-79
Joplin Remote Code Execution Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via...	High	CWE-20
MediaElement Vulnerable to Reflected XSS Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.swf in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or...	Medium	CWE-79
Prototype Pollution in immer - immer - GHSA-c36v-fmgq-m8hx immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’).	High	CWE-915
Prototype Pollution in immer - immer Affected versions of immer are vulnerable to Prototype Pollution.	High	CWE-471
Prototype Pollution in immer This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the...	High	CWE-843
Server-Side Template Injection in formio A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE:...	High	CWE-74
Apache 2.4.49 Path Traversal and RCE A vulnerability was discovered in Apache HTTP Server 2.4.49 related to changes made to path normalization. This flaw enables attackers to perform path traversal attacks,...	High	CWE-78
Apache Expect Header Cross Site Scripting Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....	High	CWE-79
Apache mod_jk Access Control Bypass The Apache Web Server (httpd) with Apache Tomcat JK (mod_jk) Connector versions 1.2.0 to 1.2.44 contains a flaw in path normalization, allowing specially crafted requests...	High
Apache mod_proxy 2.4.48 SSRF A vulnerability exists in Apache HTTP Server 2.4.48 and earlier versions, specifically within the mod_proxy module. An attacker can exploit this flaw by crafting a...	Medium	CWE-918
Apache server-info enabled Exposing the Apache server-info page allows attackers to gather detailed information about the server configuration, installed modules, and other system-related details, aiding potential attacks.	Medium	CWE-200
Apache server-status enabled Exposing the Apache server-status page allows attackers to gather detailed information about the server’s current state, facilitating potential attacks by revealing active connections, server uptime,...	Medium	CWE-200
Apache Struts 2 Forced double OGNL evaluation S2-059 The Apache Struts framework, when forced, performs double evaluation of attributes’ values assigned to certain tags attributes such as id. This allows attackers to pass...	High	CWE-78
Apache Struts 2 RCE S2-045 Apache Struts 2 suffers from a Remote Code Execution (RCE) vulnerability, designated as S2-045. This vulnerability allows attackers to execute arbitrary commands on the server...	High	CWE-78
Apache Struts 2 REST plugin XStream RCE S2-052 Apache Struts 2, specifically the REST Plugin, is susceptible to a Remote Code Execution (RCE) vulnerability identified as S2-052. This vulnerability arises due to the...	High	CWE-78
Apache Struts OGNL expression RCE S2-057 A Remote Code Execution (RCE) attack is possible in Apache Struts when alwaysSelectFullNamespace is set to true (either by the user or by a plugin...	High	CWE-78
Apache Tomcat JSP Upload RCE Apache Tomcat is susceptible to a Remote Code Execution (RCE) vulnerability when running on Windows with HTTP PUTs enabled. By sending a specially crafted request,...	High	CWE-78
Apache Tomcat Manager Login Found By default, the Tomcat Manager application should only be accessible from a browser running on the same machine as Tomcat. However, if the Manager login...	Medium
Apache Version Disclosure A misconfigured web server may expose the Apache version number either in the Server HTTP header or in the body of error pages. Attackers leverage...	Informational	CWE-200
Application and Database Error An application and database error occurs when the application encounters issues related to both its functionality and interaction with the database backend. Unhandled exceptions in...	Medium	CWE-209
Application Error Unhandled exceptions pose two primary risks. Firstly, they can lead to denial of service by causing memory leaks or excessive resource consumption. Secondly, they may...	Medium	CWE-209
Arbitrary Source Code Disclosure Arbitrary Source Code Disclosure is a vulnerability that occurs when it’s possible to access the source code of any file on a web application, potentially...	High	CWE-540
ASP.NET Version Disclosure The presence of the X-AspNet-Version and X-AspNetMvc-Version headers exposes the version of ASP.NET used by the web server, providing valuable information to attackers. This disclosure...	Informational	CWE-200
Auto Complete Enabled Password Input Enabling autocomplete for password input fields allows browsers to save and autofill sensitive information, such as passwords. This poses a security risk, particularly on shared...	Low	CWE-16
Basic Authentication Over HTTP Using Basic Authentication over HTTP exposes user credentials to potential interception by attackers who can sniff and capture HTTP traffic. This authentication method sends credentials...	Medium	CWE-319
Blind OS Command Execution Blind OS Command Execution, also known as Command Injection, is a severe vulnerability that allows attackers to execute arbitrary commands on the host operating system...	High	CWE-78
Blind SQL Injection Blind SQL Injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database without directly...	High	CWE-89
BREACH attack BREACH is a variant of the CRIME attack that targets HTTP compression, specifically gzip or DEFLATE algorithms used via the content-encoding option within HTTP. Attackers...	Low	CWE-310
Broken Link Broken hyperlinks in web pages can create a bad experience for the users. It can also affect the web page ranking in web search results....	Informational
Brute Force Prevention Bypassed Brute Force Prevention Bypassed occurs when software lacks adequate measures to counter multiple failed authentication attempts within a short time frame, rendering it vulnerable to...	Medium	CWE-307
Buffer Overflow Buffer overflow occurs when an application accepts more data than it can handle, leading to data overflowing the designated memory space. This vulnerability can be...	Medium	CWE-119
Content Character Encoding is not Defined When the character encoding is not explicitly defined in web content, browsers may resort to guessing or using a default encoding. This can lead to...	Informational	CWE-16
Content-Security-Policy Header is Missing The absence of the Content-Security-Policy (CSP) response header leaves a website vulnerable to various types of attacks, including Cross-Site Scripting (XSS) and data injection attacks....	Low	CWE-16
Cookie Accessible for Subdomains The presence of the Domain attribute in the Set-Cookie header instructs browsers to send the cookie to any subdomains of the specified domain. This can...	Informational	CWE-16
Cookie without HttpOnly Flag The absence of the HttpOnly flag in cookies allows JavaScript running on the client-side to access them through the Document.cookie API. This presents a security...	Low	CWE-16
Cookie without SameSite Flag The absence of the SameSite flag in cookies leaves them vulnerable to cross-site request forgery (CSRF) attacks, where unauthorized actions are performed on behalf of...	Low	CWE-16
Cookie without Secure Flag The absence of the Secure flag in cookies allows them to be transmitted over unencrypted connections, making them vulnerable to interception by attackers conducting man-in-the-middle...	Low	CWE-614
CRIME (SPDY) attack The CRIME (Compression Ratio Info-leak Made Easy) attack targets the SPDY protocol versions 3 and earlier, used in browsers like Mozilla Firefox and Google Chrome....	Low	CWE-310
CRIME (SSL/TLS) attack CRIME (Compression Ratio Info-leak Made Easy) is a security exploit targeting secret web cookies transmitted over HTTPS and SPDY connections utilizing data compression. By analyzing...	Low	CWE-310
CRLF Injection in URL CRLF injection involves injecting Carriage Return (ASCII 13, \r) and Line Feed (ASCII 10, \n) characters into web requests or responses. These characters are used...	High	CWE-93
Cross-Origin Resource Sharing Allowed Cross-Origin Resource Sharing (CORS) is a mechanism that uses additional HTTP headers to allow a web application running at one origin to access selected resources...	Informational	CWE-942
Cross Site Scripting Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....	High	CWE-79
Database Error A database error occurs when the application encounters an issue while interacting with the database backend. Such errors can arise due to various factors, including...	Medium	CWE-209
Detailed Application and Database Error Detailed application and database errors occur when the application encounters issues related to both its functionality and interaction with the database backend. These errors expose...	Medium	CWE-209
Detailed Application Error Detailed application errors, caused by unhandled exceptions, pose two primary risks. Firstly, they can lead to denial of service by causing memory leaks or excessive...	Medium	CWE-209
Directory Listing of Sensitive Files Directory listing of sensitive files occurs when directory listing, if enabled, exposes the complete index of resources within a directory to potential attackers. This can...	Low	CWE-548
Directory Listing Directory listing, when enabled, exposes the complete index of resources within a directory to potential attackers. This can lead to unauthorized access to sensitive files...	Low	CWE-548
Drupal 4.1/4.2 XSS Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....	High	CWE-79
Drupal 'Drupalgeddon2' Remote Code Execution A vulnerability in multiple subsystems of Drupal allows remote attackers to execute arbitrary operating system commands on the server, leading to potential compromise of the...	High	CWE-78
Drupal Module Cumulus Cross Site Scripting Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....	High	CWE-79
Drupal7 Pre Auth SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Email Address Disclosure The disclosure of email addresses on webpages can make them vulnerable to harvesting by spambots, leading to an influx of unsolicited spam emails.	Informational	CWE-200
Expression Language Injection Expression Language Injection (EL Injection) is a critical vulnerability that occurs when user inputs are used to construct dynamic expressions in web applications without proper...	High	CWE-917
File Upload Functionality The <input> element with type="file" enables users to select and upload files from their device storage to a remote server. However, unrestricted file upload functionality...	Informational
Hidden Resource in Robots.txt Hidden resources in robots.txt refer to sensitive paths or directories that are inadvertently exposed in the robots.txt file. The robots.txt file is used to instruct...	Medium	CWE-200
Host Header Injection During the processing of an incoming HTTP request, the web server relies on the Host HTTP header to determine which component or virtual host should...	Medium
HTTP Protocol Stack Remote Code Execution Vulnerability (DOS) A vulnerability in the Microsoft Windows HTTP Protocol Stack (HTTP.sys) allows remote attackers to execute arbitrary code or cause a system crash on the host...	High
HTTP Response Splitting HTTP response splitting is the result of the failure of a web application to properly sanitize CR (ASCII 0x0D) and LF (ASCII 0x0A) character in...	High	CWE-20
Insecure Deserialization Remote Code Execution Insecure deserialization remote code execution is a critical security vulnerability that occurs when an application deserializes a user-supplied object string without properly verifying its integrity....	High	CWE-502
Insecure Deserialization Insecure deserialization occurs when an application deserializes a user-supplied object string without properly verifying its integrity. This vulnerability enables attackers to manipulate the system state...	High	CWE-502
Insecure Inline Frame When an inline frame tag (<iframe>) on a webpage references an external resource without the sandbox attribute set, it allows the external URL to manipulate...	Medium	CWE-829
Internal Server Error An internal server error occurs when the server encounters an unexpected condition that prevents it from fulfilling the request. This error can result from various...	Medium	CWE-755
Joomla! 1.5 < 3.4.5 RCE OS Command Execution, also known as Command Injection, is a severe vulnerability that allows attackers to execute arbitrary commands on the host operating system. Attackers...	High	CWE-78
Joomla! < 1.7.0 XSS Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....	High	CWE-79
Joomla! 3.2.1 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Advertisement Board 3.1.0 'catname' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Aist 2.0 'id' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component AllVideos Reloaded 1.2.x 'divid' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component CcNewsletter 2.x.x 'id' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Com_cbcontact 'contact_id' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Com_contenthistory SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Com_fields 3.7 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component com_hdwplayer 4.2 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Com_newsfeeds 1.0 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Com_rsgallery2 2.0 'catid' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Com_shop 'editid' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Com_shop 'id' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component DT Register 3.2.7 'id' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Fastball 2.5 'season' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component File Download Tracker 3.0 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Form Maker 3.6.12 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Google Map Landkarten 4.2.3 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component InviteX 3.0.5 'invite_type' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component JB Bus 2.3 'order_number' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component JCK Editor 6.4.4 'parent' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component JCK Editor 6.4.4 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component JEXTN Video Gallery 3.0.5 'id' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component JGive 2.0.9 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Jobs Factory 2.0.4 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component JomEstate PRO 3.7 'id' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component JquickContact 1.3.2.2.1 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Music Collection 3.0.3 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component NextGen Editor 2.1.0 'plname' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Odudeprofile 2.8 'profession' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Reverse Auction Factory 4.3.8 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! Component Timetable Responsive Schedule For Joomla! 1.5 'alias' SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Joomla! 'J2Store < 3.3.7' SQL Injection A vulnerability in the J2Store component for Joomla! allows attackers to inject and execute SQL commands on the website’s database, potentially leading to data theft,...	High
Joomla! Pinterest Clone Social Pinboard 2.0 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
Local File Inclusion Local File Inclusion (LFI) is a vulnerability that allows attackers to include local files, exploiting dynamic file inclusion mechanisms in the target application. This occurs...	High	CWE-98
Microsoft IIS Tilde Directory Enumeration In some versions of Microsoft IIS, it is possible to detect the existence of files using an 8.3 short filename (SFN). This vulnerability allows attackers...	Medium	CWE-200
Missing or Insecure Cache-Control Header Web cache or HTTP cache is a system used to optimize web performance. Browsers cache the contents of a resource to reuse it on subsequent...	Informational	CWE-525
Nginx Code Execution due to Misconfiguration Misconfigurations in Nginx, particularly with PHP FPM (FastCGI Process Manager), can lead to a critical security vulnerability. Attackers can exploit this misconfiguration by appending /.php...	High	CWE-16
Nginx Integer Overflow Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to an integer overflow vulnerability in the nginx range filter module. This vulnerability can...	High	CWE-200
Nginx Null Byte Code Execution Allowing null byte character (ASCII 0x00) in the URL can lead to a severe security risk. If the user can manipulate file contents on the...	High	CWE-158
Nginx Restriction Bypass via Space Character in URI A vulnerability in Nginx allows attackers to bypass security restrictions in specific configurations by exploiting a flaw in request URI processing. When an unescaped space...	High	CWE-20
Nginx Version Disclosure The Server header reveals detailed information about the server application handling the request, including the Nginx version. Exposing this information can aid attackers in identifying...	Informational	CWE-200
No HTTPS In HTTP communications, traffic is not encrypted and can be captured by an attacker who has access to a network interface. This exposes sensitive information...	Medium	CWE-319
No Redirection from HTTP to HTTPS In scenarios where HTTPS is enabled but HTTP requests are not automatically redirected to HTTPS, users must explicitly use the HTTPS URL to ensure encrypted...	Medium	CWE-311
Old/Backup Resource Found Old or backup files left accessible on a web server can inadvertently expose sensitive information such as source code, administrative interfaces, or credentials. These files...	Low	CWE-530
Open Redirection In URL Unvalidated redirects and forwards occur when a web application accepts untrusted input that could redirect the user to a URL provided within the input. Attackers...	High	CWE-601
OS Command Execution OS Command Execution, also known as Command Injection, is a severe vulnerability that allows attackers to execute arbitrary commands on the host operating system. Attackers...	High	CWE-78
Passive Mixed Content When a user visits a page served over HTTPS, their connection with the web server is encrypted with TLS, protecting it from most sniffers and...	Low	CWE-319
Password Input on HTTP When passwords are sent over unencrypted HTTP traffic, attackers can intercept and capture them easily, leading to unauthorized access to user accounts, sensitive data exposure,...	Medium	CWE-319
Password Sent in HTTP Query When passwords are included in URLs and sent as part of HTTP queries, they may be logged in various places, including server logs, and disclosed...	Medium	CWE-319
Password Sent in Query When passwords are included in URLs and sent as part of HTTP queries, they may be logged in various places, including server logs, and disclosed...	Low	CWE-598
Password Sent Over HTTP When passwords are sent over unencrypted HTTP traffic, attackers can intercept and capture them easily, leading to unauthorized access to user accounts, sensitive data exposure,...	Medium	CWE-319
Path Disclosure in Robots.txt Path disclosure in robots.txt occurs when sensitive paths or directories are inadvertently exposed in the robots.txt file. The robots.txt file is used to instruct web...	Informational	CWE-200
PHP Version Disclosure Exposing the PHP version used by the server facilitates attackers in identifying vulnerabilities more easily. This information exposes the server to potential risks.	Informational	CWE-200
phpinfo() Found The phpinfo() method in PHP reveals extensive details about the PHP environment, including configuration settings, server information, and installed extensions. While useful for debugging and...	Medium	CWE-200
Possible SQL Injection Possible SQL Injection refers to a potential vulnerability where input data may be susceptible to SQL injection attacks. SQL injection is a type of attack...	High	CWE-89
Private IPv4 Address Disclosure Private IPv4 addresses are reserved for use within private networks such as local area networks (LANs). Revealing private IP addresses can provide insights into the...	Informational	CWE-200
Private IPv6 Address Disclosure Private IPv6 addresses are reserved for use within private networks and are not routable on the public Internet. Disclosing private IPv6 addresses can provide attackers...	Informational	CWE-200
Profanity The presence of profanity in web pages can create a negative user experience and may lead to decreased user engagement. Additionally, profanity can impact the...	Informational
Public-Key-Pins Header is Set The HTTP Public-Key-Pins response header was used to associate a specific cryptographic public key with a web server to mitigate the risk of MITM attacks...	Informational	CWE-16
Redirection with Body An HTTP redirection (3XX status code) typically does not include a body. However, if a body is present in the redirection response, it indicates that...	Low	CWE-698
Referrer-Policy Header is Missing The Referrer-Policy HTTP header controls the amount of referrer information (sent via the Referer header) included with requests. The Referer header contains the address of...	Informational	CWE-16
Remote File Disclosure Remote File Disclosure (RFD) is a vulnerability that allows an attacker to disclose files located on remote servers, exploiting dynamic file inclusion mechanisms implemented in...	High	CWE-98
Remote File Inclusion Remote File Inclusion (RFI) is a vulnerability that allows attackers to include remote files, exploiting dynamic file inclusion mechanisms in the target application. This occurs...	High	CWE-98
Remote URL Inclusion Remote URL Inclusion (RUI) is a vulnerability that allows an attacker to include a remote URL, exploiting dynamic URL inclusion mechanisms implemented in the target...	High	CWE-98
Robots.txt Found The robots.txt file is used to instruct web robots on which parts of a website to avoid crawling or indexing. While intended for cooperation with...	Informational	CWE-200
Secure Renegotiation is not supported When a server does not support secure renegotiation in SSL/TLS connections, it becomes vulnerable to content injection at the start of sessions. This vulnerability requires...	Low	CWE-310
Sensitive Old/Backup Resource Found Sensitive Old/Backup Resource Found refers to old or backup files left accessible on a web server, which can inadvertently expose sensitive information such as source...	Medium	CWE-530
Sensitive Unreferenced Resource Found Sensitive Unreferenced Resource Found refers to the discovery of sensitive resources within a web application that are not directly linked or referenced within the application...	Low	CWE-552
Serialized Object Found Object serialization allows transferring complex data structures over channels like HTTP. However, the presence of a serialized object within the application indicates potential vulnerabilities related...	High	CWE-502
Server Version Disclosure The Server header describes the server application that handled the request. Detailed information in this header can expose the server to attackers. Using the information...	Low	CWE-200
Session Cookie Accessible for Subdomains When the Domain attribute is present in the Set-Cookie header, browsers send the cookie to any subdomains of the specified domain. This can result in...	Low	CWE-16
Session Cookie without HttpOnly Flag The absence of the HttpOnly flag in session cookies allows client-side JavaScript to access them, which poses a security risk. Without the HttpOnly flag, session...	Medium	CWE-16
Session Cookie without SameSite Flag The absence of the SameSite flag in session cookies leaves them vulnerable to cross-site request forgery (CSRF) attacks, where unauthorized actions are performed on behalf...	Medium	CWE-16
Session Cookie without Secure Flag The absence of the Secure flag in session cookies allows them to be transmitted over unencrypted connections, making them vulnerable to interception by attackers conducting...	Medium	CWE-614
Source Code Disclosure Source code disclosure occurs when the source code of a web application is inadvertently exposed to users, potentially revealing sensitive information such as credentials, API...	Medium	CWE-540
SQL Command Disclosure SQL commands reveal information about the structure of the underlying database. This information does not create any direct impact on the target, though it provides...	Informational	CWE-89
SQL Injection SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
SSL 2 enabled SSL version 2 is known to have numerous security vulnerabilities, rendering it highly insecure and susceptible to attacks.	High	CWE-326
SSL 3 enabled SSL version 3 is vulnerable to padding oracle attacks and other cryptographic weaknesses, making it insecure for use in secure communication.	Medium	CWE-326
Strict-Transport-Security Header is Missing The absence of the HTTP Strict-Transport-Security (HSTS) response header leaves a website vulnerable to protocol downgrade attacks and session hijacking. Without this header, attackers can...	Low	CWE-16
Subresource Integrity is Missing Subresource Integrity (SRI) is a security feature that allows browsers to verify that resources fetched, such as from a content delivery network (CDN), are delivered...	Low	CWE-353
The Heartbleed Bug Heartbleed is a critical security vulnerability found in the OpenSSL cryptography library, used for implementing the Transport Layer Security (TLS) protocol. Attackers can exploit this...	High	CWE-200
The POODLE attack The POODLE attack (Padding Oracle On Downgraded Legacy Encryption) is a vulnerability that exploits SSL 3.0 fallback mechanisms in internet and security software clients. Attackers...	Medium	CWE-327
The ShellShock Bug Shellshock, also known as Bashdoor, is a critical vulnerability in the Unix Bash shell that allows attackers to execute arbitrary commands and gain unauthorized access....	High	CWE-78
Time Based SQL Injection Time Based SQL Injection is a type of SQL injection attack where the attacker manipulates the timing of SQL query execution to infer information about...	High	CWE-89
TLS 1.0 enabled TLS version 1.0 is known to have several security vulnerabilities and weaknesses, making it susceptible to attacks.	Medium	CWE-326
TLS 1.1 enabled TLS version 1.1 is known to have several security vulnerabilities and weaknesses, rendering it insecure for use.	Low	CWE-326
Tomcat Version Disclosure Exposing detailed information such as the Tomcat version number facilitates attackers in identifying vulnerabilities and planning their attacks more effectively.	Informational	CWE-200
TRACE Method Allowed The HTTP TRACE method allows clients to view the entire request received by the web server, primarily for testing and diagnostic purposes. However, enabling this...	Low	CWE-16
TRACK Method Allowed The HTTP TRACK and TRACE methods allow the client to see the entire request that the web server has received. Although primarily intended for testing...	Low	CWE-16
Unicode Transformation Issue The Unicode Standard provides a unified encoding scheme for characters worldwide, enhancing program globalization and security. However, improper usage of Unicode can introduce security vulnerabilities,...	High	CWE-176
Unix Path Disclosure File and directory paths reveal information about the structure of the file system of the underlying OS. While this information does not directly impact the...	Informational	CWE-200
Unreferenced Repository Found Unreferenced repositories, such as those from version control systems like Git, SVN, CVS, and Mercurial, contain valuable information such as source code, historical changes, and...	High	CWE-552
Unreferenced Resource Found Unreferenced resources in web applications may reveal sensitive information and provide attackers with insights into potential attack vectors. These resources, although not directly linked or...	Informational	CWE-552
Unreferenced Source Code Disclosure Unreferenced Source Code Disclosure is a vulnerability that occurs when a backup file or source code file of an application is accessible to users, potentially...	High	CWE-540
Unvalidated Redirection Unvalidated redirects and forwards occur when a web application accepts untrusted input that could redirect the user to a URL provided within the input. Attackers...	High	CWE-601
User Controllable URL User-controllable URLs refer to HTML attributes with a value type of URI, such as href in the a tag or src in the img tag....	Medium	CWE-20
User Enumeration User Enumeration occurs when web applications inadvertently reveal whether a username exists on the system, either due to misconfiguration or design decisions. Attackers exploit this...	Medium	CWE-209
ViewState is not Encrypted The ViewState, a hidden form input in ASP.NET pages, automatically persists information and application data specific to a page. If the ViewState is not encrypted,...	Informational	CWE-200
Weak Password Weak Password vulnerabilities arise when applications fail to enforce strong password policies, making it easier for attackers to guess or crack users’ passwords, leading to...	High	CWE-521
Web Server Path Traversal When a web server fails to properly normalize and validate the ../ sequence in URL paths, it enables attackers to access files outside the intended...	High	CWE-22
Werkzeug Interactive Debugging is Active Werkzeug is a comprehensive WSGI web application library for the Python language. Werkzeug provides a WSGI middleware that renders nice tracebacks, optionally with an interactive...	Medium	CWE-209
Windows Path Disclosure File and directory paths reveal information about the structure of the file system of the underlying OS. This information does not create any direct impact...	Informational	CWE-200
WordPress 4.6 Blind OS Command Execution PHPMailer before 5.2.18 allows remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code. It is possible to execute remote...	High	CWE-78
WordPress Plugin AdRotate 3.6.5 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin AdRotate 3.6.6 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin AdRotate 3.9.4 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin All Video Gallery 1.1 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Bannerize 2.8.6 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Bannerize 2.8.7 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Business Intelligence SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Chained Quiz 1.0.8 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Community Events 1.2.1 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin CP Multi View Event Calendar 1.01 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin CP Multi View Event Calendar 1.1.4 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin CP Multi View Event Calendar 1.1.7 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin DS FAQ 1.3.2 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Easy Contact Form Lite 1.0.7 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Event Registration 5.4.3 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Eventify Simple Events 1.7.f SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Facebook Promotions 1.3.3 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin File Groups 1.1.2 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin FireStorm Professional Real Estate 2.06.01 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Forum Server 1.7 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Glossary SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Google Document Embedder 2.5.14 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Google Document Embedder 2.5.16 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Hitasoft_player Ripe HD FLV Player 1.1 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Jetpack SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin JTRT Responsive Tables 4.1 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin KNR Author List Widget 2.0.0 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin LeagueManager 3.8 SQLI An SQL Injection vulnerability exists in the league_id parameter of a function call made by the leaguemanager_export page.	High
WordPress Plugin Link Library 5.2.1 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin NEX Forms 3.0 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Olimometer 2.56 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin OQey Headers 0.3 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Paid Downloads 2.01 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Post Highlights 2.2 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin SCORM Cloud 1.0.6.6 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin SH Slideshow 3.1.4 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Smart Google Code Inserter 3.5 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Tune Library 2.17 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Users Ultra 1.5.50 Blind SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin VideoWhisper Video Presentation 1.1 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin WP Fastest Cache 0.8.4.8 Blind SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin WP Statistics 13.0.7 Time Based SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin WP Support Plus Responsive Ticket System 7.1.3 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Wpfilemanager 6.8 RCE OS Command Execution, also known as Command Injection, is a severe vulnerability that allows attackers to execute arbitrary commands on the host operating system. Attackers...	High	CWE-78
WordPress Plugin Yolink Search 1.1.4 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Plugin Zotpress 4.4 SQLI SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...	High	CWE-89
WordPress Theme Akal XSS Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....	High	CWE-79
WordPress User Enumeration User Enumeration occurs when web applications inadvertently reveal whether a username exists on the system, either due to misconfiguration or design decisions. Attackers exploit this...	Medium	CWE-209
X-Content-Type-Options Header is Missing The absence of the X-Content-Type-Options response HTTP header may expose a website to MIME sniffing attacks. MIME sniffing, performed by browsers when the MIME type...	Informational	CWE-16
X-Frame-Options Header is Missing The absence of the X-Frame-Options HTTP response header leaves a website vulnerable to click-jacking attacks. Without this header, attackers can embed the site’s content into...	Low	CWE-16
X-Powered-By Header Found The presence of the X-Powered-By header reveals the technologies used by the web server, providing valuable information to attackers. This disclosure can aid attackers in...	Informational	CWE-200
X-XSS-Protection Header is Set The HTTP X-XSS-Protection response header, originally designed for Internet Explorer, Chrome, and Safari, aimed to mitigate reflected cross-site scripting (XSS) attacks. However, its effectiveness has...	Informational	CWE-16
@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability XML External entity injections could be possible, when running the provided XML Validator on arbitrary input.	High	CWE-611
lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability The latest version of lobe-chat(by now v0.141.2) has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack...	High	CWE-918
json-schema-ref-parser Prototype Pollution issue A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle(), parse(), resolve(),...	High	CWE-1321
vxe-table Cross-site Scripting vulnerability A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9. This issue affects the function export of the file...	Low	CWE-79
Malicious PDF can inject JavaScript into PDF Viewer The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then...	High	CWE-94
Trix Editor Arbitrary Code Execution Vulnerability The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with...	Medium	CWE-79
javascript-deobfuscator crafted payload can lead to code execution javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.	High	CWE-94
Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - @conform-to/yup Conform allows the parsing of nested objects in the form of object.property. Due to an improper implementation of this feature, an attacker can exploit it...	High	CWE-1321
Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - @conform-to/zod Conform allows the parsing of nested objects in the form of object.property. Due to an improper implementation of this feature, an attacker can exploit it...	High	CWE-1321
Conform contains a Prototype Pollution Vulnerability in `parseWith...` function Conform allows the parsing of nested objects in the form of object.property. Due to an improper implementation of this feature, an attacker can exploit it...	High	CWE-1321
ghtml Cross-Site Scripting (XSS) vulnerability It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting (XSS) vulnerability in some cases.	High	CWE-80
@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling A Denial-of-Service was found in the media upload process causing the server to crash without restarting, affecting either development and production environments.	Medium	CWE-248
SummerNote Cross Site Scripting Vulnerability SummerNote 0.8.18 is vulnerable to Cross Site Scripting (XSS) via the Code View Function.	Medium	CWE-79
Lobe Chat API Key Leak If an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own...	Medium	CWE-918
matrix-appservice-irc IRC command injection via admin commands containing newlines It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands...	Medium	CWE-20
datatables.net vulnerable to Prototype Pollution due to incomplete fix All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.	High	CWE-1321
Prototype Pollution in Ajv An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution...	Medium	CWE-915
Axios Cross-Site Request Forgery Vulnerability An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for...	Medium	CWE-352
Cross site scripting in datatables.net This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped....	Medium	CWE-79
Prototype Pollution in async A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user...	High	CWE-1321
Cross-site Scripting in ZenUML Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS).	Medium	CWE-80
@fastly/js-compute has a use-after-free in some host call implementations The implementation of the following functions were determined to include a use-after-free bug:	Medium	CWE-416
glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.	High	CWE-400
protobufjs Prototype Pollution vulnerability protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used...	High	CWE-1321
adolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute arbitrary code or cause a...	Medium	CWE-1321
@akbr/update Prototype Pollution akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.	Medium	CWE-1321
akbr patch-into was discovered to contain a prototype pollution via the function patchInto akbr patch-into version 1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause...	High	CWE-1321
s3-url-parser vulnerable to Denial of Service via regexes component s3-url-parser 1.0.3 is vulnerable to denial of service via the regexes component.	High	CWE-400
Blackprint @blackprint/engine Prototype Pollution issue A Prototype Pollution issue in Blackprint @blackprint/engine 0.8.12 through 0.9.1 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.	High	CWE-94
Uncontrolled resource consumption in braces The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious...	High	CWE-400
Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the...	Medium	CWE-755
jsonic was discovered to contain a prototype pollution via the function empty. rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a...	High	CWE-94
Jan path traversal vulnerability - @janhq/core An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. @janhq/core has...	High	CWE-434
EverShop vulnerable to improper authorization in GraphQL endpoints Lack of authentication in NPM’s package @evershop/evershop before version 1.0.0-rc.9, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.	High	CWE-287
@cat5th/key-serializer Prototype Pollution vulnerability harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function “query”. This vulnerability allows attackers to execute arbitrary code or cause a...	Medium	CWE-1321
Regular Expression Denial of Service in ms Versions of ms prior to 0.7.1 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.	High	CWE-400
(ReDoS) Regular Expression Denial of Service in tf2-item-format Versions of tf2-item-format since at least 4.2.6 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input.	High	CWE-624
VvvebJs Arbitrary File Upload vulnerability Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter...	Medium	CWE-434
ejs lacks certain pollution protection The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.	Medium	CWE-693
Badger Database Prototype Pollution A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.	High	CWE-94
obx Prototype Pollution almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.	High	CWE-1321
@thi.ng/paths Prototype Pollution vulnerability An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.	High	CWE-1321
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditable_regexp option, specially crafted HTML attributes containing malicious code were...	Medium	CWE-79
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when...	Medium	CWE-79
Plate media plugins has a XSS in media embed element when using custom URL parsers Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or...	High	CWE-79
jrburke requirejs vulnerable to prototype pollution jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a...	High	CWE-1321
XSS vulnerability that affects bootstrap - bootstrap In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.	Medium	CWE-79
XSS vulnerability that affects bootstrap In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.	Medium	CWE-79
Bootstrap Cross-site Scripting vulnerability - bootstrap - GHSA-4p24-vmcr-4gqj In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different...	Medium	CWE-79
Bootstrap Cross-site Scripting vulnerability In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different...	Medium	CWE-79
bootstrap Cross-site Scripting vulnerability - bootstrap-sass - GHSA-ph58-4vrj-w6hr In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.	Medium	CWE-79
bootstrap Cross-site Scripting vulnerability - bootstrap In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.	Medium	CWE-79
Bootstrap vulnerable to Cross-Site Scripting (XSS) In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.	Medium	CWE-79
Editor.js vulnerable to Code Injection Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes...	Medium	CWE-94
Scrypted Cross-site Scripting vulnerability Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior (corresponding to @scrypted/core 0.1.142 and prior), a reflected cross-site scripting vulnerability...	Medium	CWE-79
Nuxt Devtools has a Path Traversal: '../filedir Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the...	High	CWE-24
Nuxt Icon affected by a Server-Side Request Forgery (SSRF) nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/_nuxt_icon/[name].	High	CWE-918
@75lb/deep-merge Prototype Pollution vulnerability Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge...	High	CWE-1321
robinweser fast-loops vulnerable to prototype pollution robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a...	High	CWE-1321
Cross-site Scripting in quill A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute...	Medium	CWE-79
Server-Side Request Forgery in axios axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.	High	CWE-918
Jan path traversal vulnerability - @janhq/core - GHSA-5jqc-qj57-4hrc Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.	High	CWE-31
Trix has a cross-site Scripting vulnerability on copy & paste The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in...	Medium	CWE-79
Jan path traversal vulnerability An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.	High	CWE-94
gettext.js has a Cross-site Scripting injection Possible vulnerability to XSS injection if .po dictionary definition files is corrupted	High	CWE-79
Vulnerable IIS Version The Internet Information Services (IIS) version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the...	Medium
React Native Document Picker Directory Traversal vulnerability Directory Traversal vulnerability in React Native Document Picker before 8.2.2 and 9.x before 9.1.1 allows a local attacker to execute arbitrary code via a crafted...	High	CWE-26
MiguelCastillo @bit/loader Prototype Pollution issue A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argument in index.js.	High	CWE-1321
matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk’s getRoomUpgradeHistory function will infinitely recurse in...	Medium	CWE-674
squirrelly Code Injection vulnerability squirrellyjs squirrelly v9.0.0 was discovered to contain a code injection vulnerability via the component options.varName. The issue was fixed in version 9.1.0.	High	CWE-94
ag-grid packages vulnerable to Prototype Pollution - @ag-grid-enterprise/charts ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial...	Medium	CWE-1321
ag-grid packages vulnerable to Prototype Pollution - ag-grid-enterprise ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial...	Medium	CWE-1321
ag-grid packages vulnerable to Prototype Pollution ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial...	Medium	CWE-1321
Cross-site scripting in Swagger-UI A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based...	High	CWE-79
VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability A reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.5 allows remote attackers to execute arbitrary code and obtain sensitive information via the action...	Medium	CWE-79
Svelte has a potential mXSS vulnerability due to improper HTML escaping A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.	Medium	CWE-79
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS We discovered a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages...	Medium	CWE-79
ReDoS in urlregex A vulnerability was found in nescalante urlregex up to 0.5.0 and classified as problematic. This issue affects some unknown processing of the file index.js of...	Medium	CWE-1333
Prototype pollution in ag-grid-community via the _.mergeDeep function - ag-grid-enterprise ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or...	High	CWE-1321
Prototype pollution in ag-grid-community via the _.mergeDeep function ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or...	High	CWE-1321
Zod denial of service vulnerability Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails.	Medium	CWE-1333
Unreferenced Login Page Found Unreferenced Login Page Found refers to the discovery of login pages within a web application that are not directly linked or referenced within the application...	Medium	CWE-656
WordPress Login Page Found WordPress wp-login.php serves as the primary login page for both users and administrators. Attackers commonly exploit this page through password guessing and brute force attacks...	Medium
dset Prototype Pollution vulnerability Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the...	High	CWE-1321
DOM clobbering could escalate to Cross-site Scripting (XSS) - @pagefind/default-ui Pagefind initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script you load. This information is gathered by looking up...	Medium	CWE-79
DOM clobbering could escalate to Cross-site Scripting (XSS) - pagefind Pagefind initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script you load. This information is gathered by looking up...	Medium	CWE-79
DOM clobbering could escalate to Cross-site Scripting (XSS) Pagefind initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script you load. This information is gathered by looking up...	Medium	CWE-79
DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS Hi, Rspack\|Webpack developer team!	Medium	CWE-79
Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are...	High	CWE-79
json-logic-js Command Injection vulnerability A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js....	High	CWE-77
PHP CGI Argument Injection RCE In PHP, when configured as a CGI script (php-cgi), improper handling of certain query strings can allow remote attackers to execute arbitrary code. Specifically, query...	High	CWE-78
FUXA vulnerable to Local File Inclusion FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log	High	CWE-98
StimulusReflex arbitrary method call More methods than expected can be called on reflex instances. Being able to call some of them has security implications.	High	CWE-470
Denial of service in rocket chat message parser Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). Attackers who craft messages with specific characters may crash...	Medium	CWE-400
Layui has DOM Clobbering gadgets that leads to Cross-site Scripting A DOM Clobbering vulnerability has been discovered in layui that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., img...	Medium	CWE-79
DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS We discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code...	High	CWE-79
lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) SSRF protection implemented in https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides external malicious url which redirects to internal resources like...	Medium	CWE-918
Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.	Medium	CWE-79
uPlot Prototype Pollution vulnerability Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to...	High	CWE-1321
Stored XSS in Jupyter nbdime - nbdime Improper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.	Medium	CWE-79
Stored XSS in Jupyter nbdime Improper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.	Medium	CWE-79
Heap-based Buffer Overflow in sqlite-vec sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Service (DoS)...	High	CWE-787
Sentry SDK Prototype Pollution gadget in JavaScript SDKs In case a Prototype Pollution vulnerability is present in a user’s application or bundled libraries, the Sentry SDK could potentially serve as a gadget to...	Medium	CWE-913
@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plug When creating a new plugin using the git source, the user-controlled value req.body.name is used to build the plugin directory where the location will be...	High	CWE-78
@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst The endpoint /site-structure/localizer/save-string/:lang/:defstring accepts two parameter values: lang and defstring. These values are used in an unsafe way to set the keys and value of...	High	CWE-1321
@saltcorn/server arbitrary file and directory listing when accessing build mobile app results A user with admin permission can read arbitrary file and directory names on the filesystem by calling the admin/build-mobile-app/result?build_dir_name= endpoint. The build_dir_name parameter is not...	Medium	CWE-548
@saltcorn/server arbitrary file zip read and download when downloading auto backups A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file...	Medium	CWE-22
Strapi Server-Side Request Forgery (SSRF) Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or...	High	CWE-918
Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.	Medium	CWE-79
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/clean_sync_dir endpoint. The dir_name POST parameter is not validated/sanitized...	High	CWE-22
ReLaXed Cross-site Scripting vulnerability A vulnerability classified as problematic has been found in RelaxedJS ReLaXed up to 0.2.2. Affected is an unknown function of the component Pug to PDF...	Low	CWE-79
Cross-Site Scripting in jquery Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove <script> HTML tags that contain a...	Medium	CWE-79
fast-xml-parser vulnerable to ReDOS at currency parsing A ReDOS that exists on currency.js was discovered by Gauss Security Labs R&D team.	High	CWE-400
angular-base64-upload vulnerable to unauthenticated remote code execution angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploitation of this vulnerability involves uploading arbitrary file content...	High	CWE-434
Cross-site scripting (XSS) in the clipboard package - ckeditor5 During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package.	Medium	CWE-79
Cross-site scripting (XSS) in the clipboard package During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package.	Medium	CWE-79
Cross site scripting in markdown-to-jsx Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can...	Medium	CWE-79
Matrix JavaScript SDK's key history sharing could share keys to malicious devices In matrix-js-sdk versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method implements functionality proposed in MSC3061 and can...	High	CWE-287
Signature Malleabillity in elliptic The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading ‘\0’ bytes, or integer overflows. This could conceivably...	High	CWE-190
Slim Select has potential Cross-site Scripting issue Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the user-provided Options object is...	Medium	CWE-79
secp256k1-node allows private key extraction over ECDH In elliptic-based version, loadUncompressedPublicKey has a check that the public key is on the curve: https://github.com/cryptocoinjs/secp256k1-node/blob/6d3474b81d073cc9c8cc8cfadb580c84f8df5248/lib/elliptic.js#L37-L39	High	CWE-354
Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can...	Medium	CWE-80
Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS...	High	CWE-1395
ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially...	Low	CWE-1333
Knwl.js Regular Expression Denial of Service vulnerability Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or...	Medium	CWE-1333
Generation of Error Message Containing Sensitive Information in zsa All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially...	Medium	CWE-209
@langchain/community SQL Injection vulnerability A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection.	Low	CWE-89
Langchain Path Traversal vulnerability A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite...	Medium	CWE-29
Glossarizer Cross-site Scripting vulnerability Glossarizer through 1.5.2 improperly tries to convert text into HTML. Even though the application itself escapes special characters (e.g., <>), the underlying library converts these...	Medium	CWE-79
lilconfig Code Injection vulnerability Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the...	High	CWE-94
XSS in jQuery as used in Drupal, Backdrop CMS, and other products jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized...	Medium	CWE-79
@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.	Low	CWE-532
happy-dom allows for server side code to be executed by a <script> tag Consumers of the NPM package happy-dom	High	CWE-79
Regular expression denial of service in jquery-validation - jquery-validation An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input...	Low	CWE-1333
CommonRegexJS Regular Expression Denial of Service vulnerability CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service...	Medium	CWE-1333
Foundation Regular Expression Denial of Service vulnerability Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS)....	Medium	CWE-1333
insane vulnerable to Regular Expression Denial of Service insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service...	Medium	CWE-1333
JSZip contains Path Traversal via loadAsync loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.	Medium	CWE-22
Insufficient validation when decoding a Socket.IO packet A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.	Medium	CWE-754
EverShop at risk to unauthorized access via weak HMAC secret An issue was discovered in NPM’s package @evershop/evershop before version 1.0.0-rc.9. The HMAC secret used for generating tokens is hardcoded as “secret”.	High	CWE-798
socket.io has an unhandled 'error' event A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.	Medium	CWE-754
rejetto HFS vulnerable to OS Command Execution by remote authenticated users rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have...	High	CWE-78
webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted malicious code on Windows systems. This vulnerability is triggered when using...	Medium	CWE-22
CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover The issue impacts only editor instances with enabled version notifications.	Medium	CWE-79
@blakeembrey/template vulnerable to code injection when attacker controls template input It is possible to inject and run code within the template if the attacker has access to write the template name.	Medium	CWE-94
node-gettext vulnerable to Prototype Pollution All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.	High	CWE-1321
Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server Firebase JavaScript SDK utilizes a “FIREBASE_DEFAULTS” cookie to store configuration data, including an “_authTokenSyncURL” field used for session synchronization.	Medium	CWE-79
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass By combining two vulnerabilities (an Open Redirect and session token sent as URL query parameter) in Strapi framework is its possible of an unauthenticated attacker...	High	CWE-601
Open Chinese Convert subject to Denial of Service via Out-of-bounds Read Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset...	Medium	CWE-125
Cross-site scripting in bootstrap-select bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in...	Medium	CWE-79
@sveltejs/kit has unescaped error message included on error page The static error.html template for errors contains placeholders that are replaced without escaping the content first.	Low	CWE-79
Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal A vulnerability has been discovered in Agnai that permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution...	High	CWE-434
Agnai File Disclosure Vulnerability: JSON via Path Traversal https://cwe.mitre.org/data/definitions/35.html	Low	CWE-35
Agnai vulnerable to Relative Path Traversal in Image Upload A vulnerability has been discovered in Agnai that permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to...	Low	CWE-35
Nunjucks autoescape bypass leads to cross site scripting In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two...	Medium	CWE-79
@lobehub/chat Server Side Request Forgery vulnerability lobe-chat before 1.19.13 has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak...	High	CWE-918
vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/core-base XSS	Medium	CWE-79
vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/core XSS	Medium	CWE-79
vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/vue-i18n-core XSS	Medium	CWE-79
vue-i18n has cross-site scripting vulnerability with prototype pollution - vue-i18n XSS	Medium	CWE-79
vue-i18n has cross-site scripting vulnerability with prototype pollution XSS	Medium	CWE-79
@intlify/shared Prototype Pollution vulnerability - @intlify/shared Vulnerability type: Prototype Pollution	Medium	CWE-1321
@intlify/shared Prototype Pollution vulnerability - @intlify/vue-i18n-core Vulnerability type: Prototype Pollution	Medium	CWE-1321
@intlify/shared Prototype Pollution vulnerability - vue-i18n Vulnerability type: Prototype Pollution	Medium	CWE-1321
@intlify/shared Prototype Pollution vulnerability Vulnerability type: Prototype Pollution	Medium	CWE-1321
hull.js Code Injection Vulnerability Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of new Function(...) in the module...	High	CWE-94
Firepad allows insecure document access Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content...	Low	CWE-200
Prototype Pollution in the merge and clone helper methods Using merge and clone helper methods in the src/core/util.ts module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which...	Medium	CWE-915
Trix editor subject to XSS vulnerabilities on copy & paste The Trix editor, in versions prior to 2.1.9 and 1.3.3, is vulnerable to XSS + mutation XSS attacks when pasting malicious code.	Medium	CWE-79
Angular Expressions - Remote Code Execution when using locals An attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system.	High	CWE-94
Marp Core allows XSS by improper neutralization of HTML sanitization Marp Core (@marp-team/marp-core) from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization.	Medium	CWE-79
Trix allows Cross-site Scripting via `javascript:` url in a link The Trix editor, versions prior to 2.1.11, is vulnerable to XSS when pasting malicious code in the link field.	Medium	CWE-79
dom-iterator code execution vulnerability Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function...	Medium	CWE-94
json-schema is vulnerable to Prototype Pollution json-schema before version 0.4.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’).	High	CWE-915
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components.	Medium	CWE-79
@sveltejs/kit vulnerable to XSS on dev mode 404 page “Unsanitized input from the request URL flows into end, where it is used to render an HTML page returned to the user. This may result...	Low	CWE-79
path-to-regexp outputs backtracking regular expressions A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.)....	High	CWE-1333
Cross Site Scripting vulnerability in store2 Cross Site Scripting vulnerability in nbubna store v.2.14.2 and before allows a remote attacker to execute arbitrary code via the store.deep.js component	Medium	CWE-79
Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/vite-builder Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.	Medium	CWE-200
Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/webpack-builder Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site.	Medium	CWE-749
Opening a malicious website while running a Nuxt dev server could allow read-only access to code Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site.	Medium	CWE-749
Potential DoS when using ContextLines integration - @sentry/astro The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...	Low	CWE-774
Potential DoS when using ContextLines integration - @sentry/bun The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...	Low	CWE-774
Potential DoS when using ContextLines integration - @sentry/nextjs The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...	Low	CWE-774
Potential DoS when using ContextLines integration - @sentry/nuxt The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...	Low	CWE-774
Potential DoS when using ContextLines integration - @sentry/remix The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...	Low	CWE-774
Potential DoS when using ContextLines integration - @sentry/solidstart The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...	Low	CWE-774
Potential DoS when using ContextLines integration The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...	Low	CWE-774
Remote Code Execution on click of <a> Link in markdown preview There is a vulnerability in Joplin-desktop that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The...	High	CWE-94
files.photo.gallery command injection A command injection vulnerability in the video thumbnail rendering component of files.photo.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted...	Medium	CWE-77
JSONPath Plus Remote Code Execution (RCE) Vulnerability Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code...	High	CWE-94
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc An unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the...	High	CWE-79
@ndhoule/defaults prototype pollution A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.	High	CWE-1321
vxe-table prototype pollution A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.	High	CWE-1321
esbuild enables any website to send any requests to the development server and read the response esbuild allows any websites to send any request to the development server and read the response due to default CORS settings.	Medium	CWE-346
Authentication bypass in @sap/approuter The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code, an attacker can steal the session...	High	CWE-601
Prototype Pollution in handlebars - handlebars The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.	High	CWE-1321
Prototype Pollution in handlebars Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects’ __proto__ and...	High	CWE-74
dot-prop Prototype Pollution vulnerability Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language...	High	CWE-471
axios Inefficient Regular Expression Complexity vulnerability axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.	High	CWE-400
Regular Expression Denial of Service in jsoneditor JSON Editor is a web-based tool to view, edit, format, and validate JSON. It has various modes such as a tree editor, a code editor,...	Medium	CWE-697
Potential memory exposure in dns-packet This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets....	High	CWE-908
Uncontrolled Resource Consumption in ansi-html This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long...	High	CWE-400
Denial of service in css-what The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input....	High	CWE-400
Deserialization of Untrusted Data in bson All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object’s _bsontype, leading...	High	CWE-502
parse-duration has a Regex Denial of Service that results in event loop delay and out of memory This report finds 2 availability issues due to the regex used in the parse-duration npm package: An event loop delay due to the CPU-bound operation...	High	CWE-1333
cookiejar Regular Expression Denial of Service via Cookie.parse function Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function and other aspects of the...	Medium	CWE-1333
http-cache-semantics vulnerable to Regular Expression Denial of Service http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue...	High	CWE-1333
engine.io Uncaught Exception vulnerability A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.	Medium	CWE-248
word-wrap vulnerable to Regular Expression Denial of Service All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within...	Medium	CWE-1333
browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading...	High	CWE-347
Vega allows Cross-site Scripting via the vlSelectionTuples function - vega-selections The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.	Medium	CWE-79
Vega allows Cross-site Scripting via the vlSelectionTuples function The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.	Medium	CWE-79
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrack A Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long...	Medium	CWE-1333
Insecure Direct Object Reference (IDOR) IDOR occurs when an application provides direct access to objects based on user input without proper authorization checks. This vulnerability allows attackers to manipulate object...	High	CWE-639
smartbanner.js rel noopener vulnerability No description available.	Low	CWE-79
Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability The vulnerability has been discovered in Code Snippet GeSHi plugin. All integrators that use GeSHi syntax highlighter on the backend side can be affected.	Medium	CWE-79
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Back For the npm package @octokit/plugin-paginate-rest, when calling octokit.paginate.iterator(), a specially crafted octokit instance—particularly with a malicious link parameter in the headers section of the request—can...	Medium	CWE-1333
JSONPath Plus allows Remote Code Execution Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code...	High	CWE-94
Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler Missing check vulnerability in the static file handler allows any client to access the files in the server’s file system	Medium	CWE-22
Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 real-time collaboration package. This vulnerability can lead to unauthorized...	Medium	CWE-80
@tanstack/form-core prototype pollution A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.	High	CWE-732
@rpldy/uploader prototype pollution A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.	High	CWE-1321
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) Private key can be extracted from ECDSA signature upon signing a malformed input (e.g. a string or a number), which could e.g. come from JSON...	High	CWE-200
tarteaucitron Cross-site Scripting (XSS) Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(). This is related to SNYK-JS-TARTEAUCITRONJS-8366541	Low	CWE-79
Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS) Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments.	High	CWE-79
Matrix IRC Bridge allows IRC command injection to own puppeted user The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can...	Low	CWE-88
ejson shell parser in MongoDB Compass maybe bypassed MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass’ connection handling....	High	CWE-94
Cache variables with the operations when transforms exist on the root level even if variables change in the further requ When you have transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial...	Medium	CWE-401
mavo DOM Clobbering vulnerability A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.	Medium	CWE-79
seajs Cross-site Scripting vulnerability Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs package	Low	CWE-79
Manifest Uses a One-Way Hash without a Salt Manifest employs a weak password hashing implementation that uses SHA3 without a salt. This exposes user passwords to a higher risk of being cracked if...	Medium	CWE-759
Prototype pollution in json-pointer - json-pointer This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.	Medium	CWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` - @intlify/core-base Vulnerability type:Prototype Pollution	High	CWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` - @intlify/core Vulnerability type:Prototype Pollution	High	CWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` - @intlify/message-resolver Vulnerability type:Prototype Pollution	High	CWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` - @intlify/vue-i18n-core Vulnerability type:Prototype Pollution	High	CWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` - vue-i18n Vulnerability type:Prototype Pollution	High	CWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` Vulnerability type:Prototype Pollution	High	CWE-1321
Froala Editor Cross-site Scripting vulnerability Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.	Medium	CWE-79
Froala WYSIWYG editor allows cross-site scripting (XSS) Inconsistent tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.	Medium	CWE-79
JS Html Sanitizer allows XSS when used with contentEditable XSS vulnerability when the sanitizer is used with a contentEditable element to set the elements innerHTML to a sanitized string produced by the package. If...	Medium	CWE-79
canvg Prototype Pollution vulnerability An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement.	High	CWE-1321
jsPDF Bypass Regular Expression Denial of Service (ReDoS) User control of the first argument of the addImage method results in CPU utilization and denial of service.	High	CWE-770
@zag-js/core prototype pollution A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.	High	CWE-400
Open WebUI Uncontrolled Resource Consumption vulnerability In version v0.3.32 of open-webui/open-webui, the application allows users to submit large payloads in the email and password fields during the sign-in process due to...	High	CWE-400
GetmeUK ContentTools Cross-Site Scripting (XSS) A vulnerability was found in GetmeUK ContentTools up to 1.6.16. It has been rated as problematic. Affected by this issue is some unknown functionality of...	Medium	CWE-79
@mozilla/readability Denial of Service through Regex Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.	Low	CWE-1333
Directus's S3 assets become unavailable after a burst of HEAD requests There’s some tools that use Directus to sync content and assets.Some of those tools use HEAD method, like Shopify, to check the existence of files.Although,...	Medium	CWE-770
Directus's S3 assets become unavailable after a burst of malformed transformations When making many malformed transformation requests at once, at some point, all assets are being served as 403.	Medium	CWE-770
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - vega Users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library is used with the vega-interpreter.	Medium	CWE-87
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] Users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library is used with the vega-interpreter.	Medium	CWE-87
Jellyfin Web Cross-Site Scripting (XSS) via Collection Name In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the...	Medium	CWE-79
Jellyfin Web Cross-Site Scripting (XSS) via Playlist Name In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the...	Medium	CWE-79
depath and cool-path vulnerable to Prototype Pollution via `set()` Method - depath janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers...	High	CWE-1321
depath and cool-path vulnerable to Prototype Pollution via `set()` Method janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers...	High	CWE-1321
Redoc Prototype Pollution via `Module.mergeObjects` Component A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted...	High	CWE-1321
gifplayer XSS vulnerability XSS vulnerability. All versions under 0.3.7 are impacted	Medium	CWE-79
Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter.	High	CWE-444
Open WebUI Uncontrolled Resource Consumption vulnerability - open-webui In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a...	High	CWE-770
MathLive's Lack of Escaping of HTML allows for XSS Despite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the \htmlData command,...	Medium	CWE-79
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell` The Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow...	High	CWE-20
React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in...	Low	CWE-79
bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function Versions of the package bigint-buffer from 0.0.0 to 1.1.5 are vulnerable to Buffer Overflow in the toBigIntLE() function. Attackers can exploit this to crash the...	High	CWE-120
tarteaucitron.js allows UI manipulation via unrestricted CSS injection A vulnerability was identified in tarteaucitron.js, where user-controlled inputs for element dimensions (width and height) were not properly validated.	Medium	CWE-1021
tarteaucitron.js allows prototype pollution via custom text injection A vulnerability was identified in tarteaucitron.js, where the addOrUpdate function, used for applying custom texts, did not properly validate input.	Medium	CWE-1321
tarteaucitron.js allows url scheme injection via unfiltered inputs A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site’s source code or a CMS plugin) to enter a...	Medium	CWE-79
ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation Incorrect number DER encoding can lead to denial on service for absolute values in the range 231 – 232 - 1. The arithmetic in the...	Medium	CWE-835
node-opcua-alarm-condition prototype pollution vulnerability A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.	High	CWE-1321
Flowise Vulnerable to SQL Injection via `tableName` Parameter Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.	High	CWE-89
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - vega In vega 5.30.0 and lower, vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not...	Medium	CWE-79
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter In vega 5.30.0 and lower, vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not...	Medium	CWE-79
YUI Cross-site Scripting (XSS) vulnerability - yui - GHSA-x5hj-47vv-53p8 Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x...	Medium	CWE-79
YUI Cross-site Scripting (XSS) vulnerability - yui Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11,...	Medium	CWE-79
YUI Cross-site Scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11,...	Medium	CWE-79
Server-Side Request Forgery Server-Side Request Forgery (SSRF) is a vulnerability where an attacker manipulates a server to make unintended requests to internal or external resources. SSRF can be...	High	CWE-918
Cross-site Scripting in jquery-ui Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML...	Medium	CWE-79
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service glob-parent 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1.	High	CWE-400
cookie accepts cookie name, path, and domain with out of bounds characters The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value)...	Low	CWE-74
jquery-validation vulnerable to Cross-site Scripting Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder...	Medium	CWE-79
Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability A Denial of Service (DoS) vulnerability exists in open-webui/open-webui version 0.3.21. This vulnerability affects multiple endpoints, including /ollama/models/upload, /audio/api/v1/transcriptions, and /rag/api/v1/doc. The application processes multipart...	High	CWE-400
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can...	Medium	CWE-79
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - @babel/helpers When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some...	Medium	CWE-1333
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - @babel/runtime When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some...	Medium	CWE-1333
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some...	Medium	CWE-1333
QMarkdown Cross-Site Scripting (XSS) vulnerability QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set.	Medium	CWE-79
Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2 Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. If you are using one of...	High	CWE-506
tRPC 11 WebSocket DoS Vulnerability An unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11...	High	CWE-460
Pug allows JavaScript code execution if an application accepts untrusted input Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE:...	Medium	CWE-94
Prototype pollution in 101 Prototype pollution vulnerability in ‘101’ versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution....	High	CWE-1321
Homograph attack allows Unicode lookalike characters to bypass validation. Attackers can deceive users into sending funds to an unintended address.	High	CWE-1007
Information Disclosure via Flags override link - flags An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted flags ≤3.2.0 and @vercel/flags ≤3.1.1 and in certain circumstances, allowed a bad actor...	Medium	CWE-200
Information Disclosure via Flags override link An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted flags ≤3.2.0 and @vercel/flags ≤3.1.1 and in certain circumstances, allowed a bad actor...	Medium	CWE-200
Trix vulnerable to Cross-site Scripting on copy & paste The Trix editor, in versions prior to 2.1.15, is vulnerable to XSS attacks when pasting malicious code.	Low	CWE-79
OpenPGP.js's message signature verification can be spoofed A maliciously modified message can be passed to either openpgp.verify or openpgp.decrypt, causing these functions to return a valid signature verification result while returning data...	High	CWE-347
css-what vulnerable to ReDoS due to use of insecure regular expression The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the re_attr...	High	CWE-400
radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') This is a prototype pollution vulnerability. It impacts users of the set function within the Radashi library.	Medium	CWE-1321
Marked allows Regular Expression Denial of Service (ReDoS) attacks Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used...	Medium	CWE-1333
Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content Formidable (aka node-formidable) 2.x before 2.1.3 and 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is...	Low	CWE-338
Remote code execution via the `pretty` option. If a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as...	Medium	CWE-94
Strapi allows Server-Side Request Forgery in Webhook function In Strapi latest version, at function Settings -> Webhooks, the application allows us to input a URL in order to create a Webook connection. However,...	Medium	CWE-918
Resource exhaustion in engine.io Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.	High	CWE-400
path-to-regexp contains a ReDoS The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296	High	CWE-1333
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint An unauthenticated information disclosure vulnerability exists in the PSU deployment of HAX CMS via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to...	Medium	CWE-201
Suspended Directus user can continue to use session token to access API Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to...	Low	CWE-672
Regular Expression Denial of Service in papaparse Versions of papaparse prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The parse function contains a malformed regular expression that takes...	High	CWE-185
Passbolt Browser Extension leaks password information An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results...	Medium	CWE-200
OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer XSS via .py file containing script tag interpreted as HTML	Medium	CWE-79
pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos This affects both: Unsupported algos (e.g. sha3-256 / sha3-512 / sha512-256) Supported but non-normalized algos (e.g. Sha256 / Sha512 / SHA1 / sha-1 / sha-256...	High	CWE-20
PrismJS DOM Clobbering vulnerability Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript...	Medium	CWE-94
Stage.js DOM Clobbering vulnerabilty Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can...	Medium	CWE-94
string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS) string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.	Low	CWE-1333
tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir Private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is buffer package	High	CWE-522
tiny-secp256k1 allows for verify() bypass when running in bundled environment A malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is buffer package	High	CWE-347
react-native-keys insecurely stores encryption cipher and Base64 chunks react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers...	High	CWE-312
tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript A vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML...	Medium	CWE-138
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/astro Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.	High	CWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/backend Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.	High	CWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/nextjs Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.	High	CWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/nuxt Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.	High	CWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/react-router Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.	High	CWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/remix Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.	High	CWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.	High	CWE-345
MCP Inspector proxy server lacks authentication between the Inspector client and proxy Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated...	High	CWE-306
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests Possibility to craft a request that will crash the Qwik Server in the default configuration.	High	CWE-248
docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token No description available.	High	CWE-200
@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks.	Medium	CWE-79
chromedriver Downloads Resources over HTTP Affected versions of chromedriver insecurely download resources over HTTP.	High	CWE-311
Better Call routing bug can lead to Cache Deception Using a CDN that caches (/*/.png, /*/.json, /*/.css, etc…) requests, a cache deception can emerge. This could lead to unauthorized access to user sessions and...	Medium	CWE-525
DiracX-Web is vulnerable to attack through an Open Redirect on its login page An attacker can forge a request to redirect an authenticated user to any arbitrary website.	Medium	CWE-601
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/core-base The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution...	Medium	CWE-79
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/core The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution...	Medium	CWE-79
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/vue-i18n-core The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution...	Medium	CWE-79
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - vue-i18n The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution...	Medium	CWE-79
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution...	Medium	CWE-79
Prototype pollution in min-dash The set method is vulnerable to prototype pollution with specially crafted inputs.	High	CWE-1321
Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering A remote script-inclusion / stored XSS vulnerability in @nuxtjs/mdc lets a Markdown author inject a <base href="https://attacker.tld"> element.	High	CWE-79
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio(...	Medium	CWE-79
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.	Medium	CWE-362
pubnub Insufficient Entropy vulnerability Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package...	Medium	CWE-331
Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo Versions of the package bun before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun’s...	Medium	CWE-1321
Angular (deprecated package) Cross-site Scripting All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of...	Medium	CWE-79
billboard.js allows prototype pollution via the function generate billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a...	High	CWE-1321
Sensitive Data Disclosure Sensitive data disclosure occurs when confidential information such as API tokens, access keys, secrets, or credentials are exposed in publicly accessible content. This can happen...	Medium	CWE-798
webfinger.js Blind SSRF Vulnerability The lookup function takes a user address for checking accounts as a feature, however, as perthe ActivityPub spec (https://www.w3.org/TR/activitypub/#security-considerations), on thesecurity considerations section at B.3,...	Medium	CWE-918
mcp-package-docs vulnerable to command injection in several tools A command injection vulnerability exists in the mcp-package-docs MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to...	High	CWE-77
IPX Allows Path Traversal via Prefix Matching Bypass The approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end...	Medium	CWE-22
js-toml Prototype Pollution Vulnerability A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML...	High	CWE-1321
The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended A protocol compliance bug in thinbus-srp-npm versions prior to 2.0.1 causes the client to generate a fixed 252 bits of entropy instead of the intended...	Medium	CWE-331
The AuthKit React Router Library rendered sensitive auth data in HTML In versions before 0.7.0, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be...	High	CWE-200
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if you provide a policy name called __proto__ you can override the Object prototype....	High	CWE-1321
HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit When adding a “web link” to the HFS virtual filesystem, the frontend opens it with target="_blank" but without the rel="noopener noreferrer" attribute. This allows the...	Low	CWE-1022
Prototype Pollution in lodash - lodash Versions of lodash before 4.17.11 are vulnerable to prototype pollution.	High	CWE-400
Prototype Pollution in lodash Versions of lodash before 4.17.5 are vulnerable to prototype pollution.	Medium	CWE-471
Prototype Pollution in lodash - lodash - GHSA-jf85-cpcp-j695 Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor:...	High	CWE-20
Prototype Pollution in lodash - lodash-amd Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor:...	High	CWE-20
Prototype Pollution in lodash - lodash.defaultsdeep Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor:...	High	CWE-20
Prototype Pollution in lodash - lodash-es - GHSA-jf85-cpcp-j695 Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor:...	High	CWE-20
Prototype Pollution in lodash - lodash - GHSA-p6mc-m468-83gw Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to...	High	CWE-770
Prototype Pollution in lodash - lodash-es Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to...	High	CWE-770
Prototype Pollution in lodash - lodash.set Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to...	High	CWE-770
Prototype Pollution in lodash - lodash.update Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to...	High	CWE-770
Prototype Pollution in lodash - lodash.updatewith Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to...	High	CWE-770
Command Injection in lodash - lodash-es lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.	High	CWE-94
Command Injection in lodash - lodash-template lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.	High	CWE-94
Command Injection in lodash lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.	High	CWE-94
sweetalert2 contains potentially undesirable behavior sweetalert2 versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality...	Low	CWE-440
Prototype Pollution in jquery-deparam Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in jquery-deparam allows a malicious user to inject properties into Object.prototype.	High	CWE-1321
Mermaid does not properly sanitize architecture diagram iconText leading to XSS In the default configuration of mermaid 11.9.0, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for...	Medium	CWE-79
x402 SDK vulnerable in outdated versions in resource servers for builders - x402 There is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users’ keys, smart contracts, or funds.	High
x402 SDK vulnerable in outdated versions in resource servers for builders There is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users’ keys, smart contracts, or funds.	High
sweetalert2 v10.16.10 and above contains hidden functionality sweetalert2 versions 10.16.10 and up until 11.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages...	Low	CWE-912
sweetalert2 v11.4.9 and above contains hidden functionality sweetalert2 versions 11.4.9 and above are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do...	Low	CWE-912
Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,...	Medium	CWE-79
devalue prototype pollution vulnerability A string passed to devalue.parse could represent an object with a __proto__ property, which would assign a prototype to an object while allowing properties to...	High	CWE-1321
Payload does not invalidate JWTs after log out - payload Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token...	Medium	CWE-613
Payload does not invalidate JWTs after log out - @payloadcms/next Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token...	Medium	CWE-613
Payload does not invalidate JWTs after log out Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token...	Medium	CWE-613
Payload's SQLite adapter Session Fixation vulnerability - payload A Session Fixation vulnerability existed in Payload’s SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save...	Medium	CWE-384
Payload's SQLite adapter Session Fixation vulnerability - @payloadcms/next A Session Fixation vulnerability existed in Payload’s SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save...	Medium	CWE-384
Payload's SQLite adapter Session Fixation vulnerability A Session Fixation vulnerability existed in Payload’s SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save...	Medium	CWE-384
Spoofing attack in swagger-ui Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could...	Medium	CWE-922
Denial of Service in jquery Affected versions of jquery use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, jquery enters...	High	CWE-674
parse-uri Regular expression Denial of Service (ReDoS) - parse-uri An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. ## PoC	Medium	CWE-185
parse-uri Regular expression Denial of Service (ReDoS) An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. ## PoC	Medium	CWE-185
domain-suffix RegEx Denial of Service RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function.	High	CWE-1333
useragent Regular Expression Denial of Service vulnerability Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to...	Medium	CWE-1333
Mermaid improperly sanitizes sequence diagram labels leading to XSS In the default configuration of mermaid 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS....	Medium	CWE-79
CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - ckeditor5 A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading...	Low	CWE-79
CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading...	Low	CWE-79
Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter When using Astro’s Cloudflare adapter (@astrojs/cloudflare) configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn’t check the URLs...	High	CWE-918
Webrecorder packages are vulnerable to XSS through 404 error handling logic - replaywebpage A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL (derived from the original...	High	CWE-79
Webrecorder packages are vulnerable to XSS through 404 error handling logic - @webrecorder/wabac A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL (derived from the original...	High	CWE-79
Webrecorder packages are vulnerable to XSS through 404 error handling logic A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL (derived from the original...	High	CWE-79
KaTeX \htmlData does not validate attribute names KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.	Medium	CWE-79
jsPDF Denial of Service (DoS) User control of the first argument of the addImage method results in CPU utilization and denial of service.	High	CWE-835
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware The DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of duckdb’s...	High	CWE-506
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage Angular uses a DI container (the “platform injector”) to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript...	High	CWE-362
Prebid.js NPM package briefly compromised NPM users of prebid 10.9.2. The malicious code attempts to redirect crypto transactions on the site to the attackers’ wallet.	High	CWE-506
Prebid-universal-creative latest on npm briefly compromised Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular...	High	CWE-506
sanitize-html is vulnerable to XSS through incomprehensive sanitization sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags...	Medium	CWE-79
MetaMask SDK indirectly exposed via malicious [email protected] dependency - @metamask/sdk-react This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of...	Medium	CWE-506
MetaMask SDK indirectly exposed via malicious [email protected] dependency - @metamask/sdk This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of...	Medium	CWE-506
MetaMask SDK indirectly exposed via malicious [email protected] dependency This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of...	Medium	CWE-506
[email protected] contains malware after npm account takeover On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the...	High	CWE-506
[email protected] contains malware after npm account takeover On 8 September 2025, the npm publishing account for color was taken over after a phishing attack. Version 5.0.1 was published, functionally identical to the...	High	CWE-506
[email protected] contains malware after npm account takeover On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the...	High	CWE-506
Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1....	Medium	CWE-79
jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin Versions of jsondiffpatch prior to 0.7.2 are vulnerable to Cross-site Scripting (XSS) in the HtmlFormatter (HtmlFormatter::nodeBegin). When diffs are rendered to HTML using the built-in...	Medium	CWE-79
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an...	Medium	CWE-862
CodeceptJS's incomprehensive sanitation can lead to Command Injection CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without...	High	CWE-77
Decap CMS Cross Site Scripting (XSS) vulnerability Decap CMS through 3.8.3 is vulnerable to stored Cross-Site Scripting (XSS) in the admin preview pane. User-controlled fields (e.g., title, description, tags, and body) are...	Medium	CWE-79
sweetalert2 v9.17.4 and above contains hidden functionality sweetalert2 versions 9.17.4 and up until 10.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages...	Low	CWE-912
sweetalert2 v8.19.1 and above contains hidden functionality sweetalert2 versions 8.19.1 and up until 9.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages...	Low	CWE-912
Malicious versions of Nx were published Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects...	High	CWE-506
messageformat has a prototype pollution vulnerability The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key...	Low	CWE-1321
ts-fns has prototype pollution vulnerability A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided keys in the assign function allows attackers...	Medium	CWE-1321
node-cube vulnerable to prototype pollution The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allow an attacker to inject properties...	Low	CWE-1321
mpregular vulnerable to prototype pollution mpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mp.addEventHandler function of mpregular version...	High	CWE-1321
Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity A security review of the Cattown identified multiple weaknesses that could potentially impact its stability and security.	High	CWE-400
private-ip vulnerable to Server-Side Request Forgery All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide an IP or hostname that resolves to...	High	CWE-918
csvjson vulnerable to prototype injection A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.prototype via supplying a crafted payload,...	High	CWE-1321
json-schema-editor-visual vulnerable to prototype pollution json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers...	Medium	CWE-1321
dref is vulnerable to prototype pollution A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.	High	CWE-1321
lobe-chat has an Open Redirect	Medium	CWE-601
Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages We identified a cross-site scripting (XSS) vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine....	Medium	CWE-79
counterpart vulnerable to prototype pollution A vulnerability exists in the counterpart library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected...	Medium	CWE-1321
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the...	High	CWE-94
Regular Expression Denial of Service (ReDoS) in lodash - lodash-amd lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector...	Medium	CWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash-es - GHSA-x5rq-j2xg-h7qm lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector...	Medium	CWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector...	Medium	CWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash-es All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.	Medium	CWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash.trim All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.	Medium	CWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash.trimend All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.	Medium	CWE-400
Regular Expression Denial of Service (ReDoS) in lodash All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.	Medium	CWE-400
Denial of Service in content Versions of content are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a...	High
algoliasearch-helper is vulnerable to Prototype Pollution in _merge() Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to...	Medium	CWE-1321
Finance.js vulnerable to DoS via the seekZero() parameter An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.	High	CWE-770
Fiora chat group avatar is vulnerable to XSS via SVG files File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files...	Low	CWE-79
@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user When visiting a specific URL, an anonymous user could cause the NodeJS server part of Volto to quit with an error.	High	CWE-754
DocsGPT Allows Remote Code Execution A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an...	High	CWE-95
SillyTavern Web Interface Vulnerable DNS Rebinding The web UI for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for...	High	CWE-940
Finance.js vulnerable to DoS via the IRR function’s depth parameter Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper handling of the recursion/iteration limit can lead to excessive...	High	CWE-834
pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding Versions of the package pdfmake from 0.3.0-beta.1 to before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in...	High	CWE-770
MCPHub has an Improper Authorization vulnerability via its handleSseConnection function A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnection of the file src/services/sseService.ts. Such manipulation leads to improper...	Medium	CWE-287
MCPHub's ServerController is vulnerable to Command Injection A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of...	Low	CWE-77
Fiora chat user avatar is vulnerable to XSS via SVG files Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows arbitrary JavaScript execution when malicious SVG files are rendered by other users.	Low	CWE-79
Happy DOM: VM Context Escape can lead to Remote Code Execution No description available.	High	CWE-94
QGIS QWC2 Cross-Site Scripting vulnerability Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 < 2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.	Medium	CWE-79
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs Prototype pollution capabilities on various APIs.	Medium	CWE-1321
Expo SDK has an OAuth vulnerability A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the “Expo AuthSession Redirect...	High	CWE-522
`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js` sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties...	High	CWE-1321
ReDoS Vulnerability in ua-parser-js version A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js.	High	CWE-400
Mammoth is vulnerable to Directory Traversal Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth...	Medium	CWE-22
Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module	Low	CWE-918
rollbar vulnerable to prototype pollution Prototype pollution potential with the utility function rollbar/src/utility.set(). No impact when using the published public interface.	Low	CWE-1321
Potential XSS vulnerability in jQuery Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery’s DOM manipulation methods (i.e. .html(), .append(), and...	Medium	CWE-79
Strapi is vulnerable to Insufficient Session Expiration Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen...	Medium	CWE-613
rollbar vulnerable to Prototype Pollution in merge() Prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible.	Medium	CWE-1321
Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate Use of curl with the -k (or --insecure) flag in installer scripts allows attackers to deliver arbitrary executables via Man-in-the-Middle (MitM) attacks. This can lead...	High	CWE-347
validator.js has a URL validation bypass vulnerability in its isURL function A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses ‘://’ as a delimiter to parse protocols, while browsers...	Medium	CWE-79
messageformat prototype pollution vulnerability The Runtime components of messageformat package for Node.js version 3.0.1 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the...	Medium	CWE-1321
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.	High	CWE-89
Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the...	Medium	CWE-79
cipher-base is missing type checks, leading to hash rewind and passing on crafted data This affects e.g. create-hash (and crypto-browserify), so I’ll describe the issue against that packageAlso affects create-hmac and other packages	High	CWE-20
AngularJS improperly sanitizes SVG elements Improper sanitization of the value of the ‘href’ and ‘xlink:href’ attributes in ‘' SVG elements in AngularJS allows attackers to bypass common image source restrictions....	Low	CWE-791
AngularJS Incomplete Filtering of Special Elements vulnerability Improper sanitization of the value of the ‘href’ and ‘xlink:href’ attributes in ‘' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions....	Medium	CWE-791
sha.js is missing type checks leading to hash rewind and passing on crafted data This is the same as GHSA-cpq7-6gpm-g9rc but just for sha.js, as it has its own implementation.	High	CWE-20
angular vulnerable to regular expression denial of service (ReDoS) AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom...	Medium	CWE-770
angular vulnerable to regular expression denial of service via the <input type="url"> element All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the element due to the usage of an insecure...	Medium	CWE-1333
angular vulnerable to regular expression denial of service via the $resource service All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an...	Medium	CWE-1333
angular vulnerable to regular expression denial of service via the angular.copy() utility All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of...	Medium	CWE-1333
angular vulnerable to super-linear runtime due to backtracking This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear...	High	CWE-1333
AngularJS allows attackers to bypass common image source restrictions Improper sanitization of the value of the [srcset] attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a...	Low	CWE-1289
AngularJS allows attackers to bypass common image source restrictions - angular Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can...	Low	CWE-791
ansi_up cross-site scripting vulnerability The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to...	Medium	CWE-79
Arbitrary Code Execution in underscore The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when...	High	CWE-94
Prototype Pollution in jquery-bbq Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.	High	CWE-1321
Exposure of Sensitive Information to an Unauthorized Actor in nanoid The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.	Medium	CWE-704
Path Traversal: 'dir/../../filename' in moment.locale This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.	High	CWE-27
Moment.js vulnerable to Inefficient Regular Expression Complexity No description available.	High	CWE-400
Vercel ms Inefficient Regular Expression Complexity vulnerability A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file...	Medium	CWE-1333
PostCSS line return parsing error An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies,...	Medium	CWE-74
Elliptic's EDDSA missing signature length check In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be...	Low	CWE-347
Elliptic's ECDSA missing check for whether leading bit of r and s is zero In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and...	Low	CWE-130
Elliptic allows BER-encoded signatures In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.	Low	CWE-347
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to...	Medium	CWE-22
Predictable results in nanoid generation when given non-integer values When nanoid is called with a fractional value, there were a number of undesirable effects:	Medium	CWE-835
XSS in the `of` option of the `.position()` util in jquery-ui Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:	Medium	CWE-79
Volto affected by possible DoS by invoking specific URL by anonymous user When visiting a specific URL, an anonymous user could cause the NodeJS server part of Volto to quit with an error.	High	CWE-755
min-document vulnerable to prototype pollution A vulnerability exists in the ‘min-document’ package prior to version 2.19.1, stemming from improper handling of namespace operations in the removeAttributeNS method.	Low	CWE-1321
Nuxt DevTools vulnerable to cross-site scripting (XSS) A vulnerability in Nuxt DevTools has been fixed in version 2.6.4*. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations....	Medium	CWE-79
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - vega-expression Applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if “safe mode” expressionInterpreter is used.	High	CWE-79
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - vega-interpreter Applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if “safe mode” expressionInterpreter is used.	High	CWE-79
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia Applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if “safe mode” expressionInterpreter is used.	High	CWE-79
Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials) Unverified Email Change - Email as part of Credential / Unverified Account Recovery Channel Change	High	CWE-620
Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change Bypass of Password Confirmation - Unverified Password Change (authenticated change without current password)	High	CWE-620
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript...	High	CWE-95
Flowise is vulnerable to arbitrary file write through its WriteFileTool The WriteFileTool in Flowise does not restrict the file path for reading, allowing authenticated attackers to exploit this vulnerability to write arbitrary files to any...	High	CWE-22
expr-eval vulnerable to Prototype Pollution - expr-eval npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary...	High	CWE-1321
expr-eval vulnerable to Prototype Pollution npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary...	High	CWE-1321
@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a “welcome message”, which is HTML that is to be rendered on the login...	Medium	CWE-79
Bootstrap Cross-site Scripting vulnerability - bootstrap - GHSA-pj7m-g53m-7638 In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.	Medium	CWE-79
angular Prototype Pollution vulnerability Versions of angular prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function merge() does not restrict the modification of an Object’s prototype...	High	CWE-915
Angular vulnerable to Cross-site Scripting angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping <option> elements in <select>...	Medium	CWE-79
Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage.	Medium	CWE-639
authkit-nextjs may let session cookies be cached in CDNs In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in...	High	CWE-524
@hpke/core reuses AEAD nonces The public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can...	High	CWE-323
Regular Expression Denial of Service (ReDoS) in braces A vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression...	Low	CWE-400
Valibot has a ReDoS vulnerability in `EMOJI_REGEX` The EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100...	High	CWE-1333
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/astro In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...	Medium	CWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/bun In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...	Medium	CWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/nextjs In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...	Medium	CWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/node-core In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...	Medium	CWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/nuxt In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...	Medium	CWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/remix In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...	Medium	CWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/solidstart In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...	Medium	CWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...	Medium	CWE-201
Elliptic's verify function omits uniqueness validation The Elliptic package 6.5.5 for Node.js for EDDSA implementation does not perform the required check if the signature proof(s) is within the bounds of the...	Low	CWE-347
Valid ECDSA signatures erroneously rejected in Elliptic The Elliptic prior to 6.6.0 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four...	Low	CWE-347
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463	High	CWE-918
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads.	High	CWE-1321
parse is vulnerable to prototype pollution parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse allows attackers to inject properties on...	Medium	CWE-1321
OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, a user...	Medium	CWE-863
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when ‘Insert Prompt as Rich Text’ is enabled, since the...	High	CWE-79
OneUptime Unauthorized User Creation via API A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.	High	CWE-285
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists...	Low	CWE-682
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF A Stored XSS vulnerability has been discovered in Open-WebUI’s Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into...	High	CWE-79
expr-eval does not restrict functions passed to the evaluate function - expr-eval The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation,...	High	CWE-94
expr-eval does not restrict functions passed to the evaluate function The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation,...	High	CWE-94
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments CVE-2025-13877 is an authentication bypass vulnerability caused by insecure default JWT key usage in NocoBase Docker deployments.	Medium	CWE-321
Elysia vulnerable to prototype pollution with multiple standalone schema validation Prototype pollution vulnerability in mergeDeep after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must...	High	CWE-1321
Elysia affected by arbitrary code injection through cookie config Arbitrary code execution from cookie config. If dynamic cookies are enabled (ie there exists a schema for cookies), the cookie config is injected into the...	High	CWE-94
@tiptap/extension-link vulnerable to Cross-site Scripting (XSS) Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links.	Low	CWE-79
Formio improperly authorized permission elevation through specially crafted request path Summary: A flaw in path handling could allow an attacker to access protected API endpoints by sending a crafted request path. This issue could result...	High	CWE-178
EverShop is vulnerable to Unauthorized Order Information Access (IDOR) A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of the component Order Handler. The manipulation...	Low	CWE-99
Altcha Proof-of-Work obfuscation mode cryptanalytic break A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via...	Medium	CWE-327
Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component Improper neutralization of the title date in the ‘VDatePicker’ component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a...	Medium	CWE-79
Vuetify has a Prototype Pollution vulnerability The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal ‘mergeDeep’ utility function used to merge options with defaults.	High	CWE-1321
tRPC has possible prototype pollution in `experimental_nextAppDirCaller` Note that this vulnerability is only present when using experimental_caller / experimental_nextAppDirCaller.	High	CWE-1321
tinacms is vulnerable to arbitrary code execution - tinacms uses the package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary...	High	CWE-94
tinacms is vulnerable to arbitrary code execution uses the package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary...	High	CWE-94
uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) uppy’s companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.	High	CWE-918
plotly.js prototype pollution vulnerability In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.	High	CWE-1321
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass - @apollo/sandbox A Cross-Site Request Forgery (CSRF) vulnerability was identified in Apollo’s Embedded Sandbox and Embedded Explorer.	High	CWE-352
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass A Cross-Site Request Forgery (CSRF) vulnerability was identified in Apollo’s Embedded Sandbox and Embedded Explorer.	High	CWE-352
hemmelig allows SSRF Filter bypass via Secret Request functionality A Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private...	Medium	CWE-918
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS) A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of...	Medium	CWE-79
axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header When a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass.	Medium	CWE-639
evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server’s resources via the “GET /images” API....	High	CWE-1050
evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via...	Medium	CWE-918
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function ga Applications meeting these two conditions are at risk of arbitrary JavaScript code execution, even if “safe mode” expressionInterpreter is used.	High	CWE-79
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function For sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used...	High	CWE-79
misskey.js's export data contains private post data After adding private posts (followers, direct) that you do not have permission to view to your favorites or clips, you can export them to view...	High	CWE-862
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header When using an untrusted reverse proxy or not using a reverse proxy at all, attackers can bypass IP rate limiting by adding a forged X-Forwarded-For...	Medium	CWE-307
Storybook manager bundle may expose environment variables during build On December 11th, the Storybook team received a responsible disclosure alerting them to a potential vulnerability in certain built and published Storybooks.	High	CWE-541
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS...	High	CWE-749
Preact has JSON VNode Injection issue Vulnerability Type: HTML Injection via JSON Type Confusion	High	CWE-843
Trix has a stored XSS vulnerability through its attachment attribute The Trix editor, in versions prior to 2.1.16, is vulnerable to XSS attacks through attachment payloads.	Medium	CWE-79
Elliptic Uses a Cryptographic Primitive with a Risky Implementation The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of ‘k’ (as computed based on step 3.2 of RFC 6979...	Low	CWE-1240
React Router has XSS Vulnerability A XSS vulnerability exists in in React Router’s meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR...	High	CWE-79
React Router has Path Traversal in File Session Storage If applications use createFileSessionStorage() from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session...	High	CWE-22
React Router SSR XSS in ScrollRestoration A XSS vulnerability exists in in React Router’s <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary...	High	CWE-79
Orejime has executable code in HTML attributes On HTML elements handled by Orejime, one could run malicious code by embedding javascript: code within data attributes.When consenting to the related purpose, Orejime would...	Low	CWE-79
QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results...	Low	CWE-79
orval MCP client is vulnerable to a code injection attack. The MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows...	High	CWE-77
tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability A potential Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter.	Medium	CWE-1333
jQuery vulnerable to Cross-Site Scripting (XSS) Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via...	Medium	CWE-79
enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain A critical sandbox escape vulnerability exists in enclave-vm (affected: < 2.6.0, patched: 2.7.0) that can allow untrusted, sandboxed JavaScript to execute arbitrary code in the...	High	CWE-94
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse Certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted...	High	CWE-405
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions.	High	CWE-918
Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse Certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted...	High	CWE-405
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve The experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to...	High	CWE-789
Sandbox Breakout / Arbitrary Code Execution in localeval All versions of localeval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through...	High
Axios is vulnerable to DoS attack through lack of data size check When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes...	High	CWE-770
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtrac The regular expression /<([^>]+)>; rel="deprecation"/ used to match the link header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack....	Medium	CWE-1333
Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost...	Medium	CWE-918
svelte is vulnerable to XSS with textarea bind:value A server-side rendered <textarea> with two-way bound value does not have its value correctly escaped in the rendered HTML.	High	CWE-79
Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM An SQL injection vulnerability exists in the @veramo/data-store package that allows any authenticated user to execute arbitrary SQL queries against the database. The vulnerability is...	Medium	CWE-89
jsPDF has Local File Inclusion/Path Traversal vulnerability User control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal.	High	CWE-73
Unknown vulnerability in Coinbase Wallet SDK There is a security vulnerability in outdated versions of Coinbase Wallet SDK. This does not directly affect users’ keys, smart contracts, or funds.	High
Cross-Site Scripting in backbone Affected versions of backbone are vulnerable to cross-site scripting when users are allowed to supply input to the Model#Escape function, and the output is then...	Medium	CWE-79
svelte vulnerable to Cross-site Scripting An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of hydratable keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be...	Medium	CWE-79
Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership.	Low	CWE-284
flat vulnerable to Prototype Pollution flat helps flatten/unflatten nested Javascript objects. A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function...	High	CWE-1321
@envelop/graphql-modules has a Race Condition vulnerability Context race condition when using useGraphQLModules plugin	High	CWE-362
html2pdf.js contains a cross-site scripting vulnerability html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached...	High	CWE-79
Turbo Frame responses can restore stale session cookies A race condition in Turbo Frames allows delayed HTTP responses to restore stale session cookies after session-modifying operations.	Low	CWE-613
seroval Affected by Prototype Pollution via JSON Deserialization Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization.This affects only JSON deserialization functionality.	High	CWE-1321
seroval Affected by Remote Code Execution via JSON Deserialization Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution.	High	CWE-502
Seroval affected by Denial of Service via Array serialization Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time.	High	CWE-770
Seroval affected by Denial of Service via Deeply Nested Objects Serialization of objects with extreme depth can exceed the maximum call stack limit.	High	CWE-770
Modified package published to npm, containing malware that exfiltrates private key material Earlier today, a publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish...	High	CWE-200
Prototype Pollution in extend Versions of extend prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution. The extend() function allows attackers to modify the...	Medium	CWE-400
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches...	High	CWE-506
File restriction bypass in socket.io-file All versions of socket.io-fileare vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker...	High	CWE-20
Open Redirect in url-parse Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities....	High	CWE-425
Code Injection in node-rules node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function “fromJSON()” can be controlled by users without any...	High	CWE-94
Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE There is a reflected XSS vulnerability in the GET /admin/edit-codepage/:name route through the name parameter. This can be used to hijack the session of an...	High	CWE-79
CSVTOJSON has a prototype pollution vulnerability The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10....	Medium	CWE-1321
billboard.js is vulnerable to XSS during chart option binding billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.	High	CWE-79
elysia-cors Origin Validation Error An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied...	Medium	CWE-346
dcap-qvl has Missing Verification for QE Identity This vulnerability involves a critical gap in the cryptographic verification process within the dcap-qvl.	High	CWE-347
StudioCMS has Authorization Bypass Through User-Controlled Key StudioCMS contains a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the “Visitor” role to access draft content...	Medium	CWE-862
Maker.js has Unsafe Property Copying in makerjs.extendObject The makerjs.extendObject function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks hasOwnProperty() checks and does not...	Medium	CWE-1321
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that...	High	CWE-792
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments CVE-2026-23947 had an incomplete fix	High	CWE-94
LobeHub Vulnerable to Improper Authorization in Presigned Upload The file upload feature in Knowledge Base > File Upload does not validate the integrity of the upload request, allowing users to intercept and modify...	Medium	CWE-73
React2Shell (CVE-2025-66478) React2Shell is a critical unauthenticated remote code execution vulnerability affecting server-side usage of React Server Components and React Server Functions. The issue arises from a...	High	CWE-78
XML External Entity Injection (XXE) XML External Entity (XXE) injection occurs when an application parses untrusted XML input with external entity processing enabled. An attacker can define malicious external entities...	High	CWE-918
Flowise is vulnerable to arbitrary file exposure through its ReadFileTool The ReadFileTool in Flowise does not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read arbitrary files from the file system,...	High	CWE-22
jsPDF has Shared State Race Condition in addJS Plugin The addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g.,...	Medium	CWE-362
jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation) User control of the first argument of the addMetadata function allows users to inject arbitrary XML.	Medium	CWE-74
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder User control of the first argument of the addImage method results in Denial of Service.	High	CWE-770
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.	High	CWE-116
Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing An Insecure Direct Object Reference (CWE-639) has been found to exist in createHeaderBasedEmailResolver() function within the Cloudflare Agents SDK.	Medium	CWE-639
url-parse incorrectly parses hostname / protocol due to unstripped leading control characters. Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a...	Medium	CWE-639
Path traversal in url-parse url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.	Medium	CWE-23
Open redirect in url-parse - url-parse Affected versions of npm url-parse are vulnerable to URL Redirection to Untrusted Site.	Medium	CWE-601
Improper Validation and Sanitization in url-parse Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.	Medium	CWE-20
Qwik SSR XSS via Unsafe Virtual Node Serialization DescriptionA Cross-site Scripting (CWE-79) vulnerability in Qwik.js’ server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via...	Medium	CWE-79
Prototype Pollution via FormData Processing in Qwik City A Prototype Pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create...	High	CWE-1321
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using...	Medium	CWE-352
Qwik City Open Redirect via fixTrailingSlash DescriptionAn Open Redirect (CWE-601) vulnerability in Qwik City’s default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs.	Low	CWE-601
@isaacs/brace-expansion has Uncontrolled Resource Consumption @isaacs/brace-expansion is vulnerable to a Denial of Service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric...	High	CWE-1333
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) A stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be...	High	CWE-94
KaTeX's maxExpand bypassed by `\edef` KaTeX users who render untrusted mathematical expressions could encounter malicious input using \edef that causes a near-infinite loop, despite setting maxExpand to avoid such loops....	Medium	CWE-674
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability The following security vulnerability was identified in jsPDF versions <=3.0.4: Local File Inclusion/Path Traversal.	High	CWE-73
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects....	Low	CWE-918
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo...	Low	CWE-918
SCEditor has DOM XSS via emoticon URL/HTML injection If an attacker has the ability control configuration options passed to sceditor.create(), like emoticons, charset, etc. then it’s possible for them to trigger an XSS...	Medium	CWE-79
Open Chinese Convert has Out-of-bounds Write A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based...	Low	CWE-787
Sandbox escape via infinite recursion and error objects - @enclave-vm/core Note: The npm package has moved to @enclave-vm/core (formerly enclave-vm).All fixed versions and guidance refer to @enclave-vm/core.	Medium	CWE-835
Sandbox escape via infinite recursion and error objects Note: The npm package has moved to @enclave-vm/core (formerly enclave-vm).All fixed versions and guidance refer to @enclave-vm/core.	Medium	CWE-835
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters When querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL Injection attacks. An unauthenticated attacker could extract...	High	CWE-89
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments) A cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection.	Medium	CWE-639
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection The LangSmith SDK’s distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the...	Medium	CWE-918
Cube Core is vulnerable to privilege escalation via a specially crafted request It is possible to make a specially crafted request with a valid API token that leads to privilege escalation.	High	CWE-807
Cube Core is vulnerable to Denial of Service (DoS) via crafted request It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.	Medium	CWE-755
Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule The APIVersion rule uses new Function() to evaluate expression strings. A malicious crafted flow metadata file can cause arbitrary JavaScript execution during scanning. An attacker...	High	CWE-94
Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form- A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers.	Medium	CWE-352
nanotar is vulnerable to path traversal in parseTar() and parseTarGzip() nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory...	Medium	CWE-22
CASL Ability is Vulnerable to Prototype Pollution CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.	High	CWE-1321
SQL Injection in typeorm - typeorm Versions of typeorm before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary...	High	CWE-89
fast-xml-parser has RangeError DoS Numeric Entities Bug A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., &#9999999; or &#xFFFFFF;). This causes...	High	CWE-248
@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation The RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended...	Medium	CWE-918
set-in Affected by Prototype Pollution A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether...	High	CWE-1321
cap-go/capacitor-native-biometric Authentication Bypass There is a potential issue with the cap-go/capacitor-native-biometric library.	Medium	CWE-287
@farmfe/core is Missing Origin Validation in WebSocket npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket...	Medium	CWE-1385
markdown-it is has a Regular Expression Denial of Service (ReDoS) Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the...	Medium	CWE-1333
Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler Summary	Medium	CWE-79
Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground’s OAuth callback handler. The error_description query parameter was directly interpolated into an HTML...	Medium	CWE-79
beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS) beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams.	Medium	CWE-79
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking By crafting specific options parameters, the endpoint.parse(options) call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang...	Medium	CWE-1333
pbkdf2 silently disregards Uint8Array input, returning static keys On historic but declared as supported Node.js versions (0.12-2.x), pbkdf2 silently disregards Uint8Array input	High	CWE-20
BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability No description available.	Medium	CWE-573
Unauthorized npm publish of [email protected] with modified postinstall script On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on...	Low
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method User control of the argument of the addJS method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload...	High	CWE-94
devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed Under certain circumstances, unevaling untrusted data can produce output code that will create objects with polluted prototypes when later evaled, meaning the output data can...	Low	CWE-1321
devalue affected by CPU and memory amplification from sparse arrays Under certain circumstances, serializing sparse arrays using uneval or stringify could cause CPU and/or memory exhaustion. When this occurs on the server, it results in...	Low	CWE-770
Memory exhaustion in SvelteKit remote form deserialization (experimental only) Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to...	Medium	CWE-770
CPU exhaustion in SvelteKit remote form deserialization (experimental only) Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive...	Medium	CWE-843
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions User control of the first argument of the addImage method results in denial of service.	High	CWE-770
Fabric.js Affected by Stored XSS via SVG Export fabric.js applies escapeXml() to text content during SVG export (src/shapes/Text/TextSVGExportMixin.ts:186) but fails to apply it to other user-controlled string values that are interpolated into SVG...	High	CWE-79
LangChain serialization injection vulnerability enables secret extraction - @langchain/core A serialization injection vulnerability exists in LangChain JS’s toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc'...	High	CWE-502
LangChain serialization injection vulnerability enables secret extraction A serialization injection vulnerability exists in LangChain JS’s toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc'...	High	CWE-502
Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde This is a remote code execution (RCE) vulnerability. Node.js automatically imports */.plugin.{js,mjs} files including those from node_modules, so any malicious package with a .plugin.js file...	High	CWE-829
Authorization bypass in url-parse Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.	Medium	CWE-639
url-parse Incorrectly parses URLs that include an '@ A specially crafted URL with an ‘@’ sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href....	Medium	CWE-639
RediSearch Query Injection in @langchain/langgraph-checkpoint-redis A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package’s filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys...	Medium	CWE-74
Svelte affected by XSS in SSR `<option>` element In certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output....	Medium	CWE-79
Svelte affected by cross-site scripting via spread attributes in Svelte SSR Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data,...	Medium	CWE-79
Svelte SSR does not validate dynamic element tag names in `<svelte:element>` When using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the...	Medium	CWE-79
Svelte SSR attribute spreading includes inherited properties from prototype chain In server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object’s prototype chain rather than only own properties. In environments...	Medium	CWE-915
Feathers has an open redirect in OAuth callback enables account takeover The redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to...	High	CWE-601
Feathers has an origin validation bypass via prefix matching The origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed...	High	CWE-346
Feathers exposes internal headers via unencrypted session cookie All HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients.	High	CWE-200
Prototype pollution in swiper - swiper A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by...	High	CWE-1321
Pannellum has a XSS vulnerability in hot spot attributes The hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites...	Medium	CWE-79
bn.js affected by an infinite loop This affects versions of the package bn.js before 4.12.3 and 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and...	Medium	CWE-835
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE OneUptime lets project members write custom JavaScript that runs inside monitors. The problem is it executes that code using Node.js’s built-in vm module, which Node.js...	High	CWE-94
Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads A Server-Side Request Forgery (SSRF) vulnerability exists in Payload’s external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects...	Medium	CWE-918
repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard The RepoCard component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React’s dangerouslySetInnerHTML to render the repository name (repo...	Medium	CWE-79
Rollup 4 has Arbitrary File Write via Path Traversal The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization...	High	CWE-22
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Angular SSR request handling pipeline.	High	CWE-918
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader A redirect-based Server-Side Request Forgery (SSRF) bypass exists in RecursiveUrlLoader in @langchain/community. The loader validates the initial URL but allows the underlying fetch to follow...	Medium	CWE-918
Storybook Dev Server is Vulnerable to WebSocket Hijacking The WebSocket functionality in Storybook’s dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev...	High	CWE-79
FUXA has JWT Authentication Bypass via HTTP Referer header spoofing FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts...	High	CWE-288
dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() dottie versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit 7d3aee1 only validates the first segment of...	Medium	CWE-1321
Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a...	Medium	CWE-79
Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is...	Medium	CWE-79
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) The XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the...	High	CWE-776
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names No description available.	High	CWE-185
deepHas vulnerable to Prototype Pollution via constructor.prototype A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was...	High	CWE-1321
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() An OS command injection vulnerability in NetworkPathMonitor.performTraceroute() allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell...	High	CWE-78
Orval has a code injection via unsanitized x-enum-descriptions in enum generation Arbitrary code execution in environments consuming generated clients	High	CWE-94
Orval Mock Generation Code Injection via const I am reporting a code injection vulnerability in Orval’s mock generation pipeline affecting @orval/mock in both the 7.x and 8.x series. This issue is related...	High	CWE-94
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimenta Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn’t check files.length or individual files’ sizes...	Low	CWE-770
CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using...	High	CWE-79
CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in...	High	CWE-79
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.	High	CWE-96
ajv has ReDoS when using `$data` option ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern...	Medium	CWE-400
Dark Reader gives users the ability to request style sheets from local web servers Dark Reader versions prior to 4.9.117 included a behavior where a website could request a style sheet from a locally running web server, for example...	Low	CWE-668
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing cre The WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from...	High	CWE-294
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens - workflow createWebhook() in Vercel Workflow DevKit accepts a user-specified token parameter that serves as the credential for the public webhook endpoint /.well-known/workflow/v1/webhook/{token}.	Medium	CWE-287
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens createWebhook() in Vercel Workflow DevKit accepts a user-specified token parameter that serves as the credential for the public webhook endpoint /.well-known/workflow/v1/webhook/{token}.	Medium	CWE-287
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input	Low	CWE-120
Backstage vulnerable to potential reading of SCM URLs using built in token A vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths.	Low	CWE-22
fast-xml-parser vulnerable to Regex Injection via Doctype Entities “fast-xml-parser” allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching...	High	CWE-400
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the...	High	CWE-94
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding OneUptime’s GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...	High	CWE-862
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object Summary	High	CWE-749
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex A low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 by sending a forged is-multi-tenant-query header together with a controlled projectid header.	High	CWE-862
OneUptime has Synthetic Monitor RCE via exposed Playwright browser object OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container.	High	CWE-749
OneUptime has WhatsApp Resend Verification Authorization Bypass The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the...	Medium	CWE-862
StudioCMS has Privilege Escalation via Insecure API Token Generation The /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint...	High	CWE-863
Feathers has an OAuth Callback Account Takeover issue An unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service’s authentication payload...	High	CWE-287
Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type...	High	CWE-943
Elysia has a string URL format ReDoS t.String({ format: 'url' }) is vulnerable to redos	High	CWE-1333
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service The DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and...	High	CWE-639
@appium/support has a Zip Slip arbitrary file write in its ZIP extraction @appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of...	Medium	CWE-22
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" pr User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.	High	CWE-116
@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes \| Field \| Value \|\|——-\|——-\|\| Severity \| High \|\| CVSS 3.1 \| 8.	High	CWE-94
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection Download: cve_claudecodeui_submission_v2.zip	High	CWE-78
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` The contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted...	Medium	CWE-79
devalue has prototype pollution in devalue.parse and devalue.unflatten In devalue v5.6.3, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or...	Medium	CWE-1321
liquidjs has a path traversal fallback vulnerability The layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials:...	High	CWE-22
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check The S3 storage manager’s isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a...	High	CWE-863
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation The POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account....	Medium	CWE-639
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings The updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user’s notification preferences. It checks that the caller...	Medium	CWE-639
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts The REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents...	Medium	CWE-269
Tina: Path Traversal in Media Upload Handle \| Field \| Value \|\|——-\|——-\|\| Package \| @tinacms/cli \|\| Version \| 2.0.5 (latest at time of discovery) \|\| Vulnerable File \| packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts \|\| Vulnerable Lines...	High	CWE-22
@tinacms/graphql has a Path Traversal issue TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are...	Medium	CWE-22
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for...	Medium	CWE-79
Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity The link.href check in makeTagSafe (safe.ts, line 68-71) uses String.includes(), which is case-sensitive:	Low	CWE-79
flatted vulnerable to unbounded recursion DoS in parse() revive phase flatted’s parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential...	High	CWE-674
es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens` Passing functions with very long names or complex default argument names into function#copy orfunction#toStringTokens may put script to stall	Low	CWE-1333
@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe. This exposes users to potential loss of...	High	CWE-330
XSS in @leanprover/unicode-input-component Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element...	Low	CWE-80
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") The Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in...	High	CWE-79
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters The telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as...	High	CWE-89
OneUptime: Password Reset Token Logged at INFO Level The password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by...	Medium	CWE-532
crypto-js uses insecure random numbers The crypto-js package 3.2.0 for Node.js generates random numbers by concatenating the string “0.” with an integer, which makes the output more predictable than necessary....	Medium	CWE-331
mapshaper Path Traversal vulnerability Path Traversal in GitHub repository mbloch/mapshaper prior to 0.6.44.	Medium	CWE-400
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas The Select schema plugin in @pdfme/schemas constructs HTML from template-defined option values using unsanitized string interpolation and sets it via innerHTML, enabling arbitrary JavaScript execution....	Medium	CWE-79
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas The SVG schema plugin in @pdfme/schemas renders user-supplied SVG content using container.innerHTML = value without any sanitization, enabling arbitrary JavaScript execution in the user’s browser....	Medium	CWE-79
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens The REST API getUsers endpoint in StudioCMS uses the attacker-controlled rank query parameter to decide whether owner accounts should be filtered from the result set....	Low	CWE-639
NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered...	Medium	CWE-79
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint When AUTH_TOKEN and ACCESS_TOKEN environment variables are not set (which is the default out-of-the-box configuration) the /bridge HTTP endpoint is completely unauthenticated.	High	CWE-306
pdfmake is vulnerable to server-side request forgery (SSRF) Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix...	High	CWE-918
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - @ckeditor/ckeditor5-html-support A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading...	Medium	CWE-79
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading...	Medium	CWE-79
jsPDF has a PDF Object Injection via FreeText color User control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions.	High	CWE-116
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter The ensureSize() function in @dicebear/converter (versions < 9.4.0) read the width and height attributes from the input SVG to determine the output canvas size for...	High	CWE-770
jsPDF has HTML Injection in New Window paths User control of the options argument of the output function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created...	High	CWE-79
Qwik City has array method pollution in FormData processing allows type confusion and DoS Summary	High	CWE-843
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel The multiVariableText property panel in @pdfme/schemas constructs HTML via string concatenation and assigns it to innerHTML using unsanitized i18n label values. An attacker who can...	Medium	CWE-79
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled The getB64BasePdf function in @pdfme/common fetches arbitrary URLs via fetch() without any validation when basePdf is a non-data-URI string and window is defined. An attacker...	Medium	CWE-918
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads...	Medium	CWE-79
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key()...	High	CWE-89
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy paramet The fix for GHSA-p5g2-jm85-8g35 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same...	High	CWE-89
OneUptime WhatsApp Webhook Missing Signature Verification The WhatsApp POST webhook handler (/notification/whatsapp/webhook) processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged...	High	CWE-345
socket.io allows an unbounded number of binary attachments A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to...	High	CWE-754
agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` - @dfinity/identity The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which...	High	CWE-330
agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which...	High	CWE-330
Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin SDK versions between and including 5.16.0 and 5.19.0 allowed Sentry auth tokens to be set in the optional authToken configuration parameter, for debugging purposes.	Low	CWE-200
Elysia Cookie Value Prototype Pollution Elysia cookie can be overridden by prototype pollution , eg. __proto__	Medium	CWE-1321
sanitize-html Information Exposure vulnerability Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration...	Medium	CWE-538
PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` - @powersync/service-core In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users.	Medium	CWE-285
PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users.	Medium	CWE-285
`@backstage/backend-common` vulnerable to path traversal through symlinks Paths checks with the resolveSafeChildPath utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers.	High	CWE-22
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing fido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract <= 2.2.0 has a heap buffer over-read in extractStrings() —...	High	CWE-1395
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026- The fix for CVE-2026-26278 added entity expansion limits (maxTotalExpansions, maxExpandedLength, maxEntityCount, maxEntitySize) to prevent XML entity expansion Denial of Service. However, these limits are only...	High	CWE-776
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey All versions of the package sjcl are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover...	High	CWE-347
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC No description available.	High	CWE-362
Prototype Pollution via parse() in NodeJS flatted Summary	High	CWE-1321
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials - @dicebear/core SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when...	Medium	CWE-79
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when...	Medium	CWE-79
SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize() The ensureSize() function in @dicebear/converter used a regex-based approach to rewrite SVG width/height attributes, capping them at 2048px to prevent denial of service. This size...	High	CWE-185
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a...	High	CWE-1333
Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that Kysely’s DefaultQueryCompiler.sanitizeStringLiteral() only escapes single quotes by doubling them (' → '') but does not escape backslashes.	High	CWE-89
Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. The sanitizeStringLiteral method in Kysely’s query compiler escapes single quotes (' → '') but does not escape backslashes. On MySQL with the default BACKSLASH_ESCAPES SQL...	High	CWE-89
yaml is vulnerable to Stack Overflow via deeply nested YAML collections Parsing a YAML document with yaml may throw a RangeError due to a stack overflow.	Medium	CWE-674
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection resolvePartial() in the Handlebars runtime resolves partial names via a plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype has been polluted...	Medium	CWE-79
Handlebars.js has JavaScript Injection via AST Type Confusion Handlebars.compile() accepts a pre-parsed AST object in addition to a template string. The value field of a NumberLiteral AST node is emitted directly into the...	High	CWE-94
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block The @partial-block special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary...	High	CWE-94
path-to-regexp vulnerable to Denial of Service via sequential optional groups A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially...	High	CWE-400
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires...	Medium	CWE-1333
Handlebars.js has a Property Access Validation Bypass in container.lookup In lib/handlebars/runtime.js, the container.lookup() function uses container.lookupProperty() as a gate check to enforce prototype-access controls, but then discards the validated result and performs a second,...	Low	CWE-367
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry The prototype method blocklist in lib/handlebars/internal/proto-access.js blocks constructor, __defineGetter__, __defineSetter__, and __lookupGetter__, but omits the symmetric __lookupSetter__.	Medium	CWE-1321
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies happy-dom may attach cookies from the current page origin (window.location) instead of the request target URL when fetch(..., { credentials: "include" }) is used. This...	High	CWE-201
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input OpenCC versions before 1.2.0 contain two CWE-125: Out-of-bounds Read issues caused by length validation failures in UTF-8 processing. When handling malformed or truncated UTF-8 input,...	Medium	CWE-125
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation.	High	CWE-325
Cloud Metadata Disclosure Cloud Metadata Disclosure occurs when a server retrieves and discloses sensitive information from cloud metadata services. This typically happens when user-controlled input is used to...	High	CWE-918
Possible Server-Side Request Forgery A Possible Server-Side Request Forgery (SSRF) vulnerability occurs when a server appears to make outbound requests based on user-supplied input. Indicators such as response delays...	High	CWE-918
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern The replace_first filter in LiquidJS uses JavaScript’s String.prototype.replace() which interprets $& as a backreference to the matched substring. The filter only charges memoryLimit for the...	High	CWE-400
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash LiquidJS’s memoryLimit security mechanism can be completely bypassed by using reverse range expressions (e.g., (100000000..1)), allowing an attacker to allocate unlimited memory. Combined with a...	High	CWE-400
jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction...	Low	CWE-369
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code A code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside export { } declarations...	High	CWE-94
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation When a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. ``), the compiled template calls lookupProperty(decorators, "n"), which returns undefined. The runtime then...	High	CWE-754
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial A crafted object placed in the template context can bypass all conditional guards in resolvePartial() and cause invokePartial() to return undefined. The Handlebars runtime then...	High	CWE-94
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options The Handlebars CLI precompiler (bin/handlebars / lib/precompiler.js) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits,...	High	CWE-94
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node ## Summary	High	CWE-913
Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters Product: Nuxt OG ImageVersion: < 6.2.5CWE-ID: CWE-918: Server-Side Request Forgery	Medium	CWE-918
Payload has a CSRF Protection Bypass in Authentication Flow A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to...	Medium	CWE-352
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-azure The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage...	Medium	CWE-22
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-gcs The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage...	Medium	CWE-22
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-r2 The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage...	Medium	CWE-22
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage...	Medium	CWE-22
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-amd Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key...	Medium	CWE-1321
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key...	Medium	CWE-1321
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash.unset Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key...	Medium	CWE-1321
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key...	Medium	CWE-1321
lodash vulnerable to Code Injection via `_.template` imports key names - lodash-amd The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths...	High	CWE-94
lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths...	High	CWE-94
lodash vulnerable to Code Injection via `_.template` imports key names The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths...	High	CWE-94
Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions A supply chain attack on the axios npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency ([email protected]) that deploys a cross-platform remote access...	High	CWE-508
Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions Product: Nuxt OG Image Version: 6.1.2CWE-ID: CWE-404: Improper Resource Shutdown or ReleaseDescription: Failure to limit the length and width of the generated image results in...	Medium	CWE-404
Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes Product: Nuxt OG Image Version: 6.1.2CWE-ID: CWE-79: Improper Neutralization of Input During Web Page GenerationDescription: Incorrect parsing of GET parameters leads to the possibility of...	Medium	CWE-79
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files A Path Traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the...	High	CWE-73
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host - @clerk/hono The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to...	High	CWE-918
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to...	High	CWE-918
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink...	High	CWE-59
@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions @tinacms/graphql uses string-based path containment checks in FilesystemBridge:	High	CWE-59
Payload has an SQL Injection via Query Handling Certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.	High	CWE-89
@payloadcms/next has Stored XSS in Admin Panel A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when...	High	CWE-79
Payload has Authenticated SSRF via Upload Functionality An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.	High	CWE-918
SillyTavern: Path Traversal allows file existence oracle A path traversal vulnerability in the static file route handler allows any unauthenticated user to determine whether files exist anywhere on the server’s filesystem. By...	Medium	CWE-22
SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user A Path Traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json...	High	CWE-22
SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory A path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name....	High	CWE-73
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6 Distinct from CVE-2025-59159 and CVE-2026-26286 (all fixed in v1.16.0). This endpoint is still unpatched.	Medium	CWE-918
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration A stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization.	High	CWE-94
@elgentos/magento2-dev-mcp vulnerable to command injection A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to...	Low	CWE-77
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags @stablelib/cbor decodes nested CBOR structures recursively and does not enforce a maximum nesting depth. A sufficiently deep attacker-controlled CBOR payload can therefore crash decoding with...	High	CWE-674
@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding @stablelib/cbor decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named __proto__ therefore changes the...	High	CWE-1321
StableLib Ed25519 Signature Malleability via Missing S < L Check No description available.	Medium	CWE-347
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests Summary	High	CWE-352
Drizzle ORM has SQL injection via improperly escaped SQL identifiers Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was...	High	CWE-89
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck All /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload’s local API with the default overrideAccess: true, bypassing all collection-level access control. The access option...	High	CWE-862
x402 SDK Security Advisory A security vulnerability exists in outdated versions of the x402 SDK.	High
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery - payload A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset....	High	CWE-640
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset....	High	CWE-640
Pretext: Algorithmic Complexity (DoS) in the text analysis phase isRepeatedSingleCharRun() in src/analysis.ts (line 285) re-scans the entire accumulated segment on every merge iteration during text analysis, producing O(n²) total work for input consisting of...	High	CWE-407
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser The DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits.	Medium	CWE-1284
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter The replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to...	Low	CWE-400
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header The webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in...	Medium	CWE-345
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid The sort_natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on...	Medium	CWE-200
LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read liquidjs 10.25.0 documents root as constraining filenames passed to renderFile() and parseFile(), but top-level file loads do not enforce that boundary.	Medium	CWE-22
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() ##EVIDENCE	Medium	CWE-184
Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access Description:Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target...	High	CWE-918
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read Two unauthenticated path traversal vulnerabilities exist in Saltcorn’s mobile sync endpoints. The POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write...	High	CWE-22
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler The jsexprToSQL() function in Saltcorn converts JavaScript expressions to SQL for use in database constraints. The Literal handler wraps string values in single quotes without...	Low	CWE-89
Quill is vulnerable to XSS via HTML export feature A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).	Low	CWE-79
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass Under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers...	High	CWE-770
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an...	Medium	CWE-755
Zod jsVideoUrlParser vulnerable to ReDoS in util.js A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation of...	Medium	CWE-400
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates LiquidJS enforces partial and layout root restrictions using the resolved pathname string, but it does not resolve the canonical filesystem path before opening the file....	High	CWE-61
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( Severity: Medium (CVSS ~5.6)Status: Fixed in 0.5.18	Medium	CWE-1321
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation createStreamableHead({ streamKey }) interpolated its streamKey argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application...	Low	CWE-79
DbGate has cross site scripting via the SVG Icon String Handler component A security vulnerability has been detected in DbGate up to 7.1.4. This affects an unknown function of the file packages/web/src/icons/FontIcon.svelte of the component SVG Icon...	Low	CWE-79
MCPHub has an authentication bypass MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in...	Medium	CWE-639
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF Axios does not correctly handle hostname normalization when checking NO_PROXY rules.Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip...	Medium	CWE-918
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements Commit 49d0bb7 introduced a regression in sanitize-html that bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). Entity-encoded HTML inside these elements passes...	Medium	CWE-79
Flowise: Authenticated RCE Via MCP Adapters Due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving...	High	CWE-78
Flowise: Path Traversal in Vector Store basePath The Faiss and SimpleStore (LlamaIndex) vector store implementations accept a basePath parameter from user-controlled input and pass it directly to filesystem write operations without any...	Medium	CWE-22
Flowise Execute Flow function has an SSRF vulnerability The attacker provides an intranet address through the base url field configured in the Execute Flow node → Bypass checkDenyList / resolveAndValidate in httpSecurity.ts (not...	Medium	CWE-918
Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath Paperclip contains an arbitrary file read vulnerability that allows an attacker with an Agent API key to read files from the Paperclip server host filesystem.The...	Medium	CWE-73
Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization MarkdownBody, the shared component used to render every Markdown surface in the Paperclip UI (issue documents, issue comments, chat threads, approvals, agent details, export previews,...	Medium	CWE-79
Cross-site Scripting (XSS) in serialize-javascript A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript...	Medium	CWE-79
@saltcorn/data: Tenant user role is used for tenant creation role check When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can...	High	CWE-863
Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization A Prototype Pollution vulnerability was determined in brikcss merge up to 1.3.0. Executing a manipulation of the argument proto/constructor.prototype/prototype can lead to improperly controlled modification...	Medium	CWE-94
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output No description available.	Medium	CWE-79
Flowise: Cypher Injection in GraphCypherQAChain The GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are...	High	CWE-943
Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing Showdownjs, versions <= 2.1.0, anchors subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious...	Medium	CWE-777
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - @excalidraw/mermaid-to-excalidraw @excalidraw/[email protected] depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could...	Medium	CWE-79
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) @excalidraw/[email protected] depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could...	Medium	CWE-79
Flowise: Code Injection in CSVAgent leads to Authenticated RCE The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide the following payload: DataFrame({'foo': ['bar!']});import os;os.system('whoami')...	High	CWE-94
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas No description available.	High	CWE-94
Immutable is vulnerable to Prototype Pollution A Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.	High	CWE-1321
LangSmith SDK: Streaming token events bypass output redaction The LangSmith SDK’s output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming...	Medium	CWE-532
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability ZDI-CAN-29412: FlowiseAI Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability	High	CWE-77
Flowise: Parameter Override Bypass Remote Command Execution Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword...	High	CWE-20
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains A Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI’s POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP...	High	CWE-918
Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) The core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the...	High	CWE-918
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - xmldom @xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without...	High	CWE-91
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion @xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without...	High	CWE-91
Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/astro createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.	High	CWE-863
Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/nextjs createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.	High	CWE-863
Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/shared createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.	High	CWE-863
Official Clerk JavaScript SDKs: Middleware-based route protection bypass createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.	High	CWE-863
Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and...	High	CWE-918
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) A critical SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary...	High	CWE-89
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability Trend Micro’s Zero Day Initiative has identified a vulnerability affecting FlowiseAI Flowise.	High	CWE-184
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) The fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts (line 28) uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects...	Low	CWE-918
Axios HTTP/2 Session Cleanup State Corruption Vulnerability Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. This...	Medium	CWE-400
Unsafe object property setter in mathjs This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can...	High	CWE-915
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer A critical Denial of Service (DoS) vulnerability exists in [email protected]. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline...	High	CWE-835
copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token of the component Header Handler. Executing...	Low	CWE-350
Arbitrary code execution in protobufjs protobufjs could execute generated JavaScript code derived from protobuf schema metadata. When loading a crafted JSON descriptor, schema-controlled type names and type references could reach...	High	CWE-94
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams No description available.	Low	CWE-626
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` No description available.	Medium	CWE-915
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Ax 1. Executive SummaryThis report documents an incomplete security patch for the previously disclosed vulnerability GHSA-3p68-rc4w-qgx5 (CVE-2025-62718), which affects the NO_PROXY hostname resolution logic in the...	High	CWE-918
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy No description available.	Medium	CWE-287
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion No description available.	Medium	CWE-201
Axios: Header Injection via Prototype Pollution A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability...	High	CWE-1321
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking When Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify...	High	CWE-1321
Axios: HTTP adapter streamed responses bypass maxContentLength When responseType: ‘stream’ is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.	Medium	CWE-770
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when...	Medium	CWE-770
Axios: no_proxy bypass via IP alias allows SSRF The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of...	Medium	CWE-918
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream The FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls...	Medium	CWE-93
auth-js Vulnerable to Insecure Path Routing from Malformed User Input The library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a...	Low	CWE-22
@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Ori Anonymous GitHub fetches repository content (e.g., markdown files) from GitHub’s API and renders it without sanitization. On the client side, markdown is parsed with marked...	High	CWE-80
MCPHub has Path Traversal via Malicious MCPB Manifest Name MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest is directly concatenated into a file...	High	CWE-22
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack In simple words, some programs that use _.flatten or _.isEqual could be made to crash. Someone who wants to do harm may be able to...	High	CWE-770
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: icu-minify’s runtime formatter resolves select branches by looking up the runtime value as a plain property on a prototype-bearing object. When the value coerces to...	Low	CWE-1321
BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/src/http/aiProxyMiddleware.mts of the component...	Medium	CWE-918
CyberChef has a Cross-site Scripting issue GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets(‘%3Cscript substring.	High	CWE-79
@diplodoc/search-extension allows stored XSS via Markdown file title @diplodoc/search-extension 1.0.0 through 3.0.2 allows stored XSS via .md file title.	Medium	CWE-79
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig No description available.	High	CWE-754
Electerm runWidget has a path traversal that leads to arbitrary code execution The runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation:	High	CWE-829
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click Electerm’s terminal hyperlink handler passes any URL clicked in the terminal directly to shell.openExternal without any protocol validation.	High	CWE-88
Electerm's full process.env exposed to renderer via window.pre.env The getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is...	Medium	CWE-312
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor A code execution (RCE) vulnerability exists in electerm’s SFTP open with system editor or “Edit with custom editor” feature. When a user opts to edit...	High	CWE-88
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with...	High	CWE-79
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading The queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The...	High	CWE-89
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can...	High	CWE-915
xmldom has XML node injection through unvalidated comment serialization - xmldom The package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment breaking sequences. As a result, an attacker can terminate...	High	CWE-91
xmldom has XML node injection through unvalidated comment serialization The package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment breaking sequences. As a result, an attacker can terminate...	High	CWE-91
xmldom has XML node injection through unvalidated processing instruction serialization - xmldom The package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker...	High	CWE-91
xmldom has XML node injection through unvalidated processing instruction serialization The package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker...	High	CWE-91
xmldom has XML injection through unvalidated DocumentType serialization - xmldom The package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatimwithout any escaping or validation. When these fields are set programmatically to attacker-controlledstrings, XMLSerializer.serializeToString can produce...	High	CWE-91
xmldom has XML injection through unvalidated DocumentType serialization The package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatimwithout any escaping or validation. When these fields are set programmatically to attacker-controlledstrings, XMLSerializer.serializeToString can produce...	High	CWE-91
xmldom: Uncontrolled recursion in XML serialization leads to DoS - xmldom Seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeplynested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the...	High	CWE-674
xmldom: Uncontrolled recursion in XML serialization leads to DoS Seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeplynested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the...	High	CWE-674
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters No description available.	Medium	CWE-91
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward...	Medium	CWE-601
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns Versions of i18next-http-backend prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation,...	Medium	CWE-74
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes Versions of i18nextify prior to 4.0.8 substitute `` interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution...	Medium	CWE-94
Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods A vulnerability in the Inngest TypeScript SDK versions 3.22.0 through 3.53.1 allows unauthenticated remote attackers to exfiltrate environment variables from the host process via the...	High	CWE-497
electerm: electerm_install_script_CommandInjection Vulnerability Report Command Injection vulnerabilities in electerm:	High	CWE-77
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment A critical Remote Code Execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. The issue has...	High	CWE-94
FUXA has a hardcoded fallback JWT signing secret FUXA used a static fallback JWT signing secret (frangoteam751) when no secretCode was configured.	High	CWE-798
electerm has Command Injection via runLinux funtion Command Injection vulnerabilities in electerm:	High	CWE-77
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking Five config properties in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype...	High	CWE-1321
protobuf.js: Code injection through bytes field defaults in generated toObject code protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string...	High	CWE-94
query-parser-string is vulnerable to Prototype Pollution NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly...	High	CWE-1321
youtube-regex vulnerable to Regex Denial of Service Regex Denial of Service in youtube-regex npm package through version 1.0.5.	High	CWE-400
SillyTavern has a Path Traversal issue POST /api/extensions/delete endpoint accepts extensionName: "." which bypasses sanitize-filename validation, causing the entire user extensions directory to be recursively deleted. No authentication is required in...	High	CWE-22
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - marko When dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase...	Medium	CWE-79
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping When dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase...	Medium	CWE-79
i18next-locize-backend has URL Injection via Unsanitized Path Parameters Versions of i18next-locize-backend prior to 9.0.2 interpolate lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath...	Medium	CWE-74
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor Versions of the locize client SDK (the browser module that wires up the locize InContext translation editor) prior to 4.0.21 register a window.addEventListener("message", …) handler...	High	CWE-79
Electerm users can run dangrous code through link or command line No description available.	High	CWE-94
RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions Server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site...	Medium	CWE-352
liquidjs has a Denial of Service via circular block reference in layout A circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the...	High	CWE-674
Angular Expressions - Remote Code Execution using filters An attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system.	High	CWE-95
Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) Flowise introduced SSRF protections through a centralized HTTP security wrapper (httpSecurity.ts) that implements deny-list validation and IP pinning logic.	Medium	CWE-918
@workos/authkit-session has an Open Redirect via state-derived redirect target An open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter.	Medium	CWE-601
link-preview-js vulnerable to IPv6 and internal loopback attacks The library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP....	High	CWE-918
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled...	High	CWE-754
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution The vulnerability was automatically discovered by an ai agent and then manually verified.	Medium	CWE-79
Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections The metascraper-logo-favicon plugin makes HTTP requests to URLs extracted from attacker-controlled HTML without going through the application’s validateUrl() SSRF protections. This allows any authenticated user...	High	CWE-918
Svelte: SSR XSS via Insecure Promise Serialization in hydratable Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true: you...	Medium	CWE-79
protobuf.js: Denial of service through unbounded protobuf recursion protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message...	High	CWE-674
protobufjs has overlong UTF-8 decoding - @protobufjs/utf8 protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decoder accepted overlong UTF-8 byte sequences and decoded them to...	Medium	CWE-176
protobufjs has overlong UTF-8 decoding protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decoder accepted overlong UTF-8 byte sequences and decoded them to...	Medium	CWE-176
protobuf.js: Process-wide denial of service through unsafe option paths protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option...	High	CWE-1321
protobuf.js: Code generation gadget after prototype pollution protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted,...	High	CWE-94
protobuf.js: Prototype injection in generated message constructors protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an...	Medium	CWE-1321
protobuf.js: Denial of service from crafted field names in generated code protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated...	Medium	CWE-20
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins NocoBase’s workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can...	Medium	CWE-918
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - nitro A proxy route rule like:	Medium	CWE-22
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` A proxy route rule like:	Medium	CWE-22
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Imperson A critical identity spoofing vulnerability in MCPHub allows any unauthenticated user to impersonate any other user — including administrators — on SSE (Server-Sent Events) and...	High	CWE-290
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - @backstage/plugin-catalog-unprocessed-entities-common The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This...	Medium	CWE-863
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This...	Medium	CWE-863
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying No description available.	Medium	CWE-307
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions No description available.	Low	CWE-613
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions No description available.	Low	CWE-613
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) The isBlockedUrl() denylist introduced in [email protected] to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete.	Low	CWE-918
Flowise has an MCP Security Bypass that Enables RCE There are three bypass methods for the security limitations of the Flowise MCP feature, and attackers can execute arbitrary commands by combining these three methods...	High	CWE-184
open-webui Vulnerable to Stored XSS via Model Description [!IMPORTANT] Relationship to CVE-2024-7990	High	CWE-79
Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Ex The tool update endpoint (POST /api/v1/tools/id/{id}/update) is missing the workspace.tools permission check that is present on the tool create endpoint.	High	CWE-862
Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML A stored cross-site scripting (XSS) vulnerability affected entry summary rendering in Sveltia CMS.	Low	CWE-79
automagik-genie has a command injection vulnerability Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit function in dist/mcp/server.js...	High	CWE-78
@tmlmobilidade/utils has prototype pollution in its setValueAtPath Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().	High	CWE-1321
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp - @mistralai/mistralai-azure Mistral npm @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp were compromised by a supply chain attack related to the TanStack security incident. An automated worm associated with the attack...	Low	CWE-506
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp - @mistralai/mistralai Mistral npm @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp were compromised by a supply chain attack related to the TanStack security incident. An automated worm associated with the attack...	Low	CWE-506
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp Mistral npm @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp were compromised by a supply chain attack related to the TanStack security incident. An automated worm associated with the attack...	Low	CWE-506
Open WebUI Has Stored Cross-Site Scripting in SVG Renderer There is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation.	Medium	CWE-80
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order A Stored Cross-Site Scripting (XSS) vulnerability exists in the Banner component due to an improper sanitization order (specifically, DOMPurify is executed before the marked library)....	High	CWE-79
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON().	Medium	CWE-674
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE The MCP module’s ReplServer binds to all interfaces (0.0.0.0:4403) and exposes a /execute endpoint that runs arbitrary code with zero authentication. Anyone on the network...	High	CWE-749
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain No description available.	Medium	CWE-918
seroval affected by Denial of Service via RegExp serialization Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can...	High	CWE-1333
electerm allows unauthorized users to execute arbitrary commands An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary commands via unverified request to electerms service.	High	CWE-78
Strapi may leak sensitive data via relational filtering due to lack of query sanitization No description available.	High	CWE-943
@tootallnate/once vulnerable to Incorrect Control Flow Scoping Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains...	Low	CWE-705
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided The v3(), v5(), and v6() API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large...	Medium	CWE-787
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects What kind of vulnerability is it?	Medium	CWE-834
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty The _copyProps function in lib/src/object/copy.ts uses for…in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (proto, constructor,...	High	CWE-1321
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS CryptPad’s HTML sanitizer in Diffmarked.js can be bypassed due to incomplete filtering of restricted tags.Because the sanitizer only validates the src attribute of <iframe> <video>,...	Medium	CWE-79
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection Pre-auth RCE in FUXA via Logic Bypass	High	CWE-94
LiquidJS is Vulnerable to Remote Code Execution It is possible to execute arbitrary code with crafted templates	High	CWE-94
@kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment...	Low	CWE-200
@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue A vulnerability was determined in Vercel AI up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils....	Low	CWE-400
AgenticMail API/storage and outbound relay hardening fixes The current upstream main branch at commit 7e0206d was reviewed, and the fix-first patch set was rebased on 2026-05-18.	High	CWE-89
Bootstrap Vulnerable to Cross-Site Scripting - bootstrap Versions of bootstrap prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The data-template attribute of the tooltip and...	Medium	CWE-79
Bootstrap Vulnerable to Cross-Site Scripting Versions of bootstrap prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The data-template attribute of the tooltip and...	Medium	CWE-79
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted...	High	CWE-400
React Router vulnerable to Denial of Service via reflected user input in single-fetch A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying...	High	CWE-770
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner DbGate’s JSON script runner (POST /runners/start) allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value...	High	CWE-94
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE The unzipDirectory() function in packages/api/src/shell/unzipDirectory.js (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries...	High	CWE-22
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate DbGate is vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an...	High	CWE-78
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute...	High	CWE-79
Insufficient Entropy in cryptiles Versions of cryptiles prior to 4.1.2 are vulnerable to Insufficient Entropy. The randomDigits() method does not provide sufficient entropy and its generates digits that are...	High	CWE-331
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError....	Medium	CWE-674
TeleJSON: DOM XSS via unsanitised constructor name in `new Function()` telejson versions prior to 6.0.0 (released 2022) are vulnerable to DOM-based Cross-Site Scripting (XSS) through unsafe deserialisation. Attacker-controlled input from the _constructor-name_ property in parsed...	Low	CWE-79
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests...	High	CWE-918
Bootstrap Cross-site Scripting vulnerability - bootstrap - GHSA-7mvr-5x2g-wfc8 In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar...	Medium	CWE-79
Bootstrap Cross-site Scripting vulnerability - bootstrap-sass In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar...	Medium	CWE-79
Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures classDef values with...	Medium	CWE-94
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection Under the default configuration, Mermaid state diagram’s classDef allow DOM injection that escapes the SVG, although <script> tags are removed, preventing XSS.	Medium	CWE-94
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.	High	CWE-94
Velocity.js has a Prototype Pollution vulnerability through #set path assignment A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application...	High	CWE-1321
Auth.js SDK has Improper Permission Checking Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is...	High	CWE-863
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (for example in a DM) can cause...	High	CWE-20
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when...	High	CWE-1321
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/arktype-adapter On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/eslint-plugin-router On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/history On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-router-devtools On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-router-ssr-query On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-router On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-start-client On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-start-rsc On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-start On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-core On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-devtools-core On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-devtools On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-generator On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-plugin On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-ssr-query-core On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-utils On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-vite-plugin On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-router-devtools On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-router-ssr-query On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-router On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-start-client On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-start On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/start-client-core On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/start-storage-context On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/valibot-adapter On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/virtual-file-routes On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-router-devtools On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-router-ssr-query On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-router On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-start-client On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-start On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...	High	CWE-506
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` Kysely 0.28.12 added a sanitizeStringLiteral() call inside DefaultQueryCompiler.visitJSONPathLeg (commit 0a602bf, PR #1727) to fix CVE-2026-32763 (GHSA-wmrf-hv6w-mr66). The fix only doubles single quotes (' → '');...	High	CWE-915
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning The LangSmith SDK’s prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub....	High	CWE-502
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover A critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. The issue has been fixed.	Medium	CWE-347
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro A redirect route rule like:	Medium	CWE-601
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules A redirect route rule like:	Medium	CWE-601
Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark No description available.	High	CWE-94
electerm's encrypt method not safe enough No description available.	Medium	CWE-916
@ranfdev/deepobj has a Prototype Pollution vulnerability Prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input.	High	CWE-1321
form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with...	High	CWE-1321
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates.	Medium	CWE-835
Mermaid: Improper sanitization of configuration leads to CSS injection Mermaid’s default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options.	Medium	CWE-94
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass Neotoma versions starting at v0.6.0 can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token...	Medium	CWE-306
React Router has CSRF issue in Action/Server Action Request Processing React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework...	Medium	CWE-352
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover Changing a user’s password does not invalidate existing sessions, allowing an attacker with a stolen cookie to retain access even after the victim resets their...	High	CWE-613
SillyTavern has Authentication Bypass via SSO Header Injection SillyTavern 1.18.0 now includes a configuration option to limit which IP addresses can authorize using SSO headers, limiting to just loopback addresses by default. A...	High	CWE-807
SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body.	Medium	CWE-79
SillyTavern has a SSRF vulnerability in the CORS proxy middleware SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting).	Medium	CWE-918
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting).	High	CWE-918
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/astro has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/backend has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/chrome-extension has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/clerk-expo has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/clerk-js has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/clerk-react has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/expo has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/hono has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/nextjs has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/nuxt has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/react-router has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/react has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/shared has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/vue has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...	High	CWE-863
Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability The kanban npm package (used by the cline CLI) starts a WebSocket server on 127.0.0.1:3484 with no Origin header validation. Any website a developer visits...	High	CWE-306
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-amd Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash...	Medium	CWE-1321
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-es Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash...	Medium	CWE-1321
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash.unset Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash...	Medium	CWE-1321
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash...	Medium	CWE-1321
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection.	High	CWE-770
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis Multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled...	High	CWE-918
HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of the <video-player> component.	Medium	CWE-79
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of <iframe> elements.	High	CWE-79
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of <iframe> elements.	High	CWE-79
Svelte: ReDoS in `<svelte:element>` Tag Validation An internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. You are only vulnerable to this if you allow...	Medium	CWE-1333
Svelte devalue: DoS via sparse array deserialization devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to...	High	CWE-770
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.	Medium	CWE-79
Svelte SSR vulnerable to cross-site scripting via spread attributes When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled...	Medium	CWE-79
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) A cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including	High	CWE-87
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system Papra’s webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal...	Low	CWE-918
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name...	High	CWE-400
Element Call reports full URLs of visited pages to analytics server Element Call versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a posthog key in config.json or by the...	High	CWE-200
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts The OpenZeppelin Contracts Wizard generated Hardhat (test/test.ts) and Foundry (test/<Name>.t.sol) example test files that interpolated user-supplied strings (opts.name, opts.uri) into the test source without escaping....	High	CWE-94
@cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize...	Medium	CWE-79
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection js-cookie’s internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object’s "__proto__" member is...	High	CWE-1321
Cross-site scripting in Survey Creator Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title...	Medium	CWE-79
wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function There is a cross-site scripting (XSS) issue in wangEditor via the image upload function in version 4.7.11. This issue has been fixed in version 4.7.12....	Medium
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access A NoSQL injection vulnerability existed in MongoDBSaver where checkpoint identifier fields from config.configurable were used in MongoDB queries without strict type enforcement.	Medium	CWE-943
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios...	High	CWE-200
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows.	High	CWE-201
Allocation of Resources Without Limits or Throttling in Axios Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter.	High	CWE-770
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix No description available.	Low	CWE-1321
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions axios 1.15.2 exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios...	Medium	CWE-1321
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` No description available.	High	CWE-441
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge Axios versions before the fixed releases contain prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse,...	High	CWE-94
joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.	Medium	CWE-400
esbuild allows arbitrary file read when running the development server on Windows The development server contains a path traversal vulnerability on Windows when serving files from servedir.	Low	CWE-22
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation (CDVWKInAppBrowser.m:560–574).	High	CWE-20
actual Allows Electron to Run As Node A electron run as node vulnerability was identified in actual (macOS application, version 25.x (Electron 39.2.7)).	Medium	CWE-94
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in...	High	CWE-79
React Router: Potential CSRF via PUT/PATCH/DELETE document requests Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests.	Low	CWE-352
UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()` A regular expression denial-of-service (ReDoS) vulnerability has been discovered in ua-parser-js when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an...	Medium	CWE-400
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and...	Medium	CWE-770
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations A quadratic time complexity vulnerability exists in markdown-it’s smartquotes rule (enabled via the typographer: true option). An attacker can craft a markdown input consisting of...	Medium	CWE-407
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - @nuxt/webpack-builder This is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev...	Medium	CWE-749
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re This is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev...	Medium	CWE-749
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx TinaCMS rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs —...	Medium	CWE-87
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes TinaCMS rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs —...	Medium	CWE-87
Privilege Escalation in cordova-plugin-inappbrowser Versions of cordova-plugin-inappbrowser prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in...	High	CWE-79
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated s - @openzeppelin/wizard-cairo The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line...	Low	CWE-94
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated s - @openzeppelin/wizard-stellar The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line...	Low	CWE-94
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated s - @openzeppelin/wizard-stylus The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line...	Low	CWE-94
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated s The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line...	Low	CWE-94
TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB) Blind SQL injection vulnerability in UpdateQueryBuilder and SoftDeleteQueryBuilder affecting MySQL and MariaDB users.	Medium	CWE-89
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-chat-ui In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...	Medium	CWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-chat In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...	Medium	CWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-claude-code In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...	Medium	CWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-code-completion In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...	Medium	CWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-core In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...	Medium	CWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-ide In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...	Medium	CWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...	Medium	CWE-201
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-chat-ui In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-chat In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-claude-code In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-code-completion In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-core In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-ide In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...	High	CWE-829
[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions - @theia/debug In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker...	High	CWE-829
[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions - @theia/task In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker...	High	CWE-829
[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-chat-ui In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-chat In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-claude-code In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-code-completion In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-core In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...	High	CWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...	High	CWE-829
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover - @tinacms/app TinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on...	High	CWE-940
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover TinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on...	High	CWE-940
ts-deepmerge: Prototype Method Override leads to DoS Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf)....	Medium	CWE-248
Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe A stored cross-site scripting (XSS) vulnerability affected the Markdown/RichText field preview renderer in Sveltia CMS.	Low	CWE-79
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests Uni-CLI versions before 0.225.2 exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could...	High	CWE-352
scimPatch vulnerable to prototype pollution via unfiltered keys in patch scim-patch performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "__proto__.someProp". After one such patch,Object.prototype.someProp is set process-wide,...	High	CWE-1321
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion...	Medium	CWE-79
neotoma has tenant isolation gap in relationship query endpoints The /list_relationships and /retrieve_graph_neighborhood endpoints call getAuthenticatedUserId (confirming a valid session exists) but do not pass the resolved user ID into the Supabase query as...	Low	CWE-201
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) Prototype Pollution in internal assign() helper in Linkify allows remote attackers to execute arbitrary JavaScript (Stored or Reflected XSS) via injection of event handlers through...	High	CWE-1321
MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 MJML before 5.0.0-alpha.9 allows mj-include directory traversal to test file existence and (in the type=”css” case) read files. NOTE: this issue exists because of an...	Medium	CWE-36
Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties In some circumstances, devalue.parse and devalue.unflatten could emit objects with __proto__ own properties. This in and of itself is not a security vulnerability (and is...	Low	CWE-1321
LinkifyIt#match scan loop has quadratic algorithmic complexity LinkifyIt.prototype.match — the package’s primary public API — has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails. This is not a regex...	High	CWE-1333
better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server A directory traversal vulnerability exists in the production static file server of better-helperjs (<= 3.0.5). Attackers can read arbitrary files located in adjacent directory structures...	High	CWE-22
Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication No description available.	High	CWE-862
js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals js-toml versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written parseBigInt loop that multiplies a BigInt accumulator...	High	CWE-407
@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub @microsoft/kiota-http-fetchlibrary’s RedirectHandler is documented as stripping Authorization and Cookie from cross-origin redirect targets, but the default scrubSensitiveHeaders callback in RedirectHandlerOptions uses case-sensitive property deletion (delete...	Medium	CWE-200
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users...	High	CWE-79
@sveltejs/kit: `query.batch` cross-talk query.batch() could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data...	Medium	CWE-200
@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization The network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows private network...	Medium	CWE-918
wetty vulnerable to DOM XSS via file-download filename The wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (escapeMarkup: false). Any output...	High	CWE-79
sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced The documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked.	High	CWE-347
@asymmetric-effort/specifyjs: URL parse failure silently allows request Location: core/src/shared/secure-fetch.ts:42-45	High	CWE-918
@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection Location: core/src/client/graphql.ts:66-80	Medium	CWE-943
@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state Location: core/src/core/scheduler.ts:23, core/src/hooks/dispatcher.ts:100, core/src/client/graphql.ts:71	Medium	CWE-209
@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range) Location: core/src/shared/secure-fetch.ts:52-54	Medium	CWE-918
@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction Location: core/src/shared/secure-fetch.ts:33-35	Medium	CWE-918
@asymmetric-effort/specifyjs: No redirect target validation in secureFetch Location: core/src/shared/secure-fetch.ts	Medium	CWE-918
@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString Location: core/src/server/render-to-string.ts:307-311	Medium	CWE-79
@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields A CPU exhaustion vulnerability exists in Conform’s parseSubmission future API when parsing FormData or URLSearchParams submissions with many unique field names.	High	CWE-407
electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling A path traversal vulnerability exists in the Zmodem and Trzsz file download handlers in electerm. When receiving files via Zmodem or Trzsz protocols, electerm uses...	High	CWE-22
electerm has Command Injection in File System Operations (rmrf, mv, cp) A command injection vulnerability exists in electerm’s file system operations (rmrf, mv, cp) in src/app/lib/fs.js. These functions construct shell commands by interpolating file paths directly...	High	CWE-78
Electerm Local code through electerm's single-instance socket No description available.	High	CWE-940
@enclave-vm/core is vulnerable to Sandbox Escape It is possible to escape the security boundraries set by @enclave-vm/core, which can be used to achieve remote code execution (RCE).	High	CWE-94
karma-mojo enables OS Command Injection karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.	High	CWE-78
Injection in op-browser op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.	High	CWE-78
Decompress: Archive extraction can create files and links outside of the target directory When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that...	High	CWE-732
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation.	High	CWE-79
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) - @nuxt/webpack-builder This is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server...	Medium	CWE-749
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) This is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server...	Medium	CWE-749
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning The /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those...	Low	CWE-79
Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` When experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and...	Medium	CWE-288
DbGate: Remote Code Execution via functionName injection in loadReader endpoint The POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation.	High	CWE-94
Waku: Cross-Origin CSRF on RSC Server Action Dispatch Waku’s RSC request dispatcher invokes server actions without validating the request’s Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser...	Medium	CWE-352
Waku has an Open Redirect via `unstable_redirect` Helper The unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...	Low	CWE-601
Claw Orchestrator is missing authentication for the component API Endpoint A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint....	Medium	CWE-287
Claw Orchestrator has inefficient regular expression complexity via validateRegex() A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0. The impacted element is the function validateRegex of the file claw-orchestrator/src/embedded-server.ts of the...	Medium	CWE-400
Potential XSS vulnerability in jQuery - jquery Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery’s DOM manipulation methods (i.e. .html(), .append(), and others) may execute...	Medium	CWE-79
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS The strip_html filter in liquidjs is intended to remove HTML tags from a string before rendering, and is widely used as an XSS sanitizer. The...	Medium	CWE-79
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body The renderLimit option — documented in docs/source/tutorials/dos.md as the mechanism that “mitigates this by limiting the time consumed by each render() call” — can be...	Medium	CWE-400
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` Context.spawn() in liquidjs creates a child Context for the {% render %} tag but does not propagate the parent context’s resolved ownPropertyOnly value. The new...	Medium	CWE-693
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) The date filter’s strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart() in src/util/underscore.ts.	High	CWE-400
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex The built-in strip_html filter in liquidjs uses a regex containing four lazy-quantified alternatives. When the input contains many <script, <style, or <!-- opener tokens without...	High	CWE-1333
tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element...	Medium	CWE-285
DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search....	Low	CWE-400
DesktopCommanderMCP is vulnerable to SSRF A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the...	Low	CWE-918
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the current IPv4 validation logic...	High	CWE-918
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ The _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__...	Low	CWE-1321
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize...	High	CWE-79
obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr The Local REST API’s /vault/{path} endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path inside the handler — after Express has already routed and normalized it, then hand...	High	CWE-22
Embedded malware in ua-parser-js The npm package ua-parser-js had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and...	High	CWE-912
protobufjs: Denial of service through unbounded Any expansion during JSON conversion protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any...	High	CWE-674
@babel/core: Arbitrary File Read via sourceMappingURL Comment Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these...	Low	CWE-22
protobufjs : Schema-derived names can shadow runtime-significant properties protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or...	Medium	CWE-754
protobufjs: Memory amplification from preserved unknown fields in binary decode protobufjs 8.2.0 added support for preserving unknown fields encountered during binary decode. Affected versions preserved unknown wire elements in message.$unknowns and did not provide a...	Medium	CWE-770
websocket-driver: Message corruption via abuse of protocol length headers The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a...	High	CWE-130
websocket-driver: Resource limit bypass via message compression If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger...	Medium	CWE-770
ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag When parsing an image with an embedded ICC profile that contains a crafted multiLocalizedUnicodeType (mluc) tag, ExifReader can be made to allocate memory proportional to...	High	CWE-1284
ExifReader is vulnerable to denial of service via unbounded decompression of image metadata Versions of ExifReader from 4.20.0 through 4.38.1 do not bound the size of decompressed metadata blocks. When a caller invokes the asynchronous API (e.g. ExifReader.load(file)...	Medium	CWE-409
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification g PUT /api/basemap (the basemap import endpoint) fetches an attacker-supplied URL server-side with no SSRF protection whatsoever. Any authenticated user can submit a JSON body {...	Medium	CWE-918
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader The TypeScript Prompty loader used gray-matter without overriding executable frontmatter engines. gray-matter supports JavaScript frontmatter blocks such as ---js and evaluates them while parsing. An...	High	CWE-94
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes ExifReader 4.40.0 can throw an uncaught RangeError: Offset is outside the bounds of the DataView while parsing crafted HEIC/AVIF files. The file only needs a...	Medium	CWE-755
CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification No description available.	High	CWE-918
Angular's deprecated package has a Cross-Site Scripting issue A flaw in AngularJS’ Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within...	High	CWE-791
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default @andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default...	High	CWE-668
Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization A potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method.	Medium	CWE-79
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CV shouldBypassProxy, introduced in v1.15.0 to fix CVE-2025-62718, does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a...	High	CWE-918
Dash apps vulnerable to Cross-site Scripting - dash-core-components Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package...	Medium	CWE-79
Dash apps vulnerable to Cross-site Scripting Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package...	Medium	CWE-79
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json....	Medium	CWE-770
Axios: Excessive recursion in formDataToJSON can cause denial of service Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform...	Medium	CWE-674
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints Users are affected if all of the following are true:	High	CWE-918
LobeHub: Unauthenticated SSRF in `/webapi/proxy` No description available.	High	CWE-918
@better-auth/sso: SSO provider may allow registration for any org member without a checking their role You are affected if all of the following are true:	High	CWE-863
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag The _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping:	Low	CWE-79
Socket.IO: Engine.IO Polling Transport Connection Exhaustion An unauthenticated remote attacker can cause a denial of service in affected versions of engine.io by opening Engine.IO polling sessions and sending an invalid binary...	High	CWE-404
protobufjs: Denial of Service via infinite loop in .proto option parsing protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema...	Medium	CWE-835
protobufjs: Text Format string map parsing can mutate returned map object prototype The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key __proto__ could therefore change the prototype...	Medium	CWE-1321
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NO_PROXY rules. In Node.js applications that use HTTP_PROXY or HTTPS_PROXY together...	Medium	CWE-918
Axios: Prototype pollution gadgets can alter axios request construction axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in...	Medium	CWE-1321
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` axios’ fetch adapter does not enforce maxBodyLength for live WHATWG ReadableStream request bodies whose size cannot be determined before dispatch. Applications that use adapter: "fetch"...	Medium	CWE-770
Axios: HTTP/2 streamed uploads bypass `maxBodyLength` Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2.	Medium	CWE-400
Axios: Nested axios option objects can consume polluted prototype values Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype.	Medium	CWE-1321
Axios form serializer maxDepth bypass via {} metatoken Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in lib/helpers/toFormData.js. When serializing an object with a top-level key ending...	Medium	CWE-674
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before...	High	CWE-200
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridg Two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while a sibling handler in the same repo does....	High	CWE-306
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync() to a deterministic runtime path. On typical macOS environments, and on Linux sessions where $XDG_RUNTIME_DIR is...	Medium	CWE-59
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or...	High	CWE-835
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in...	High	CWE-338
jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can...	High	CWE-681
jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.set Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related...	High	CWE-347
js-toml has silent type confusion via falsy-primitive duplicate-key bypass js-toml’s interpreter checks whether a key already exists in a parser-built container with if (object[key]) instead of if (key in object). When the prior value...	Medium	CWE-697
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS List#set, List#setSize, List#setIn, List#updateIn (and the functional set / setIn / updateIn) mishandle an index or size in the range [2 30, 2 ...	High	CWE-835
Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly.	High	CWE-407
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text linkify-it’s schema-scan loop (.test() / .match(), the documented public API) invokes the mailto:schema validator at every mailto: occurrence in the input text. For each occurrence...	High	CWE-407
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header @opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent() without handling decode errors. A single request carrying a malformed percent-encoded value (for example a bare %)...	High	CWE-248
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry This is a credential-exposure / credential-confusion issue.	High	CWE-522
fast-uri vulnerable to host confusion via literal backslash authority delimiter fast-uri v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node’s native WHATWG URL (used by fetch(), undici, and Node’s...	High	CWE-436
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments PostCSS’s PreviousMap parses the /# sourceMappingURL=PATH / comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme,...	High	CWE-22
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce CWE: CWE-770 (Allocation of Resources Without Limits or Throttling) — sibling class of GHSA-8xx9-69p8-7jp3 and GHSA-2546-xv4c-mc8g, applied to memoryLimit instead of renderLimit	High	CWE-770
SvelteKit: Big remote form function payloads can cause Node process to crash Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.	Medium	CWE-248
SvelteKit: Prototype pollution in file input deletion path in remote-function forms If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are...	Medium	CWE-1321
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization A type confusion issue in seroval.fromJSON() allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table...	High	CWE-843
Valibot: record() issue paths can make flatten() throw for inherited Object property names valibot 1.4.1 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty.	Medium	CWE-755
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer The TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute...	High	CWE-94
mathlive's Lack of Escaping of HTML allows for XSS - mathlive Despite the 0.104.0 patch escaping attribute-bearing constructs (\htmlData, \href), text-content reflection was missed. The \text{}, \mbox{} commands accept arbitrary characters in their body and emit...	Medium	CWE-116
degit has a Command Injection issue Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for...	High	CWE-78
d3-color vulnerable to ReDoS The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service....	High	CWE-400
AWS Amplify Studio UI Component Properties Has an Input Validation Issue The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities (components, forms, views, and themes) primarily used in AWS...	High	CWE-95
jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set() Jodit.modules.Helpers.set(chain, value, obj) walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__,...	Medium	CWE-1321
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.	High	CWE-1321
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS jodit’s sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim().indexOf('javascript') === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl...	Medium	CWE-83
Jodit has prototype pollution via Jodit.configure() / ConfigMerge Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under...	Medium	CWE-1321
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier jodit’s built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer’s element walk, so a no-interaction event...	High	CWE-83
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit’s clean-html sanitizer.	Medium	CWE-80
sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos sanitize-html uses allowedSchemesAppliedToAttributes (default: ['href', 'src', 'cite']) to gate the naughtyHref() function that blocks dangerous URI schemes like javascript: and vbscript:.	Medium	CWE-79
Prompty: Arbitrary file read via file reference expansion Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use...	High	CWE-22
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `f The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile() that restricts an attacker-controlled sourceMappingURL (from a CSS comment) to a .map extension and, for...	Medium	CWE-22
Socket.IO: Zero-attachment Memory Exhaustion A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to...	High	CWE-754
fast-uri vulnerable to host confusion via backslash authority introducer fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority...	High	CWE-436
jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion Before JSONata 2.2.0 and 1.8.9, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex....	High	CWE-1333
Flowise RCE via TypeORM DataSource ============================================================================= Security Advisory elttam	High	CWE-94
Flowise Sandbox Escape to RCE ============================================================================= Security Advisory elttam	High	CWE-95
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override A sandbox escape vulnerability in executeJavaScriptCode() allows any authenticated user to execute arbitrary system commands as root on the Flowise server.	High	CWE-94
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.	High	CWE-94
Flowise RCE via SQLite Record Manager Node ============================================================================= Security Advisory elttam	High	CWE-94
Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) The mitigation shipped for CVE-2025-8943 blocks the -y and --yes flags on npx to stop auto-installation of arbitrary packages. That flag filter works. The environment-variable...	High	CWE-184
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the...	High	CWE-184
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys Flowise on current main allows an authenticated user with documentStores:preview-process permission to trigger the S3 Directory document loader with attacker-controlled S3 object keys.	High	CWE-73
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation Flowise’s CSVAgent interpolates an attacker-controlled segment of thecsvFile data URI directly into a Python source-code template that is thenexecuted by Pyodide. Because Pyodide is loaded...	High	CWE-95
Flowise: Remote Code Execution Vulnerability in CSVAgent The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to...	High	CWE-94
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components – ABSTRACT ————————————-	High	CWE-94
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. escapeValue() dispatches on the type of the parameter value, and two of...	High	CWE-89
@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration UForm and UAuthForm render a server-side <form> element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If...	Medium	CWE-598
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin.	High	CWE-94
Mermaid XY Charts are vulnerable to an infinite loop DoS Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.	Medium	CWE-835
Mermaid Architecture diagrams are vulnerable to prototype pollution Rendering an untrusted architecture-beta diagram lets the diagram author write an arbitrary property with the value horizontal or vertical onto Object.prototype. A group id of...	Medium	CWE-1321
Mermaid allows CSS injection applying to sibling elements of the diagram Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with #mermaid-X, sibling (~ and +) combinators can still escape...	Medium	CWE-94
Mermaid configuration APIs allow prototype pollution Mermaid’s configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid’s internal config using the assignWithDepth deep-merge helper that is vulnerable to...	Low	CWE-1321
Mermaid radar diagrams are vulnerable to DoS Mermaid radar diagrams allow arbitrary large values for ticks, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until...	Medium	CWE-606
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no...	High	CWE-79
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 ngx-extended-pdf-viewer embeds a fork of Mozilla’s pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json.	High	CWE-1103
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted Accept headers. The impact is mitigated by default header length limits on most platforms, but...	Medium	CWE-1333
Axios: Prototype pollution auth subfields can inject Basic auth Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype...	Medium	CWE-1321
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain CryptoJS.lib.WordArray.random() in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces...	High	CWE-338
nanoid: non-secure generators can loop indefinitely with negative size nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given...	High	CWE-835
showdown allows stored cross-site scripting through table header ID injection showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes.	Medium	CWE-79
showdown metadata title handling allows cross-site scripting showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript.	Medium	CWE-79
fast-uri vulnerable to path traversal via percent-encoded dot segments fast-uri v3.1.0 and earlier decodes percent-encoded path separators (%2F) and dot segments (%2E) before applying dot-segment removal in normalize() and equal(). This makes encoded path...	High	CWE-22
Trix has a Stored XSS vulnerability through serialized attributes The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer.	Medium	CWE-79
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController) The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when a crafted application/x-trix-document JSON payload is dropped into the editor in environments...	Low	CWE-79
Trix: Stored XSS via HTMLParser attribute injection on paste The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock...	Medium	CWE-79
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header Severity: MediumCVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVSS suggested base score: ~6.1 — Medium *(Re-validate in the first.gov calculator before filing.	Medium	CWE-79
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink- src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts both compute their temporary working-file paths as:	Medium	CWE-59
ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartex Etherpad’s device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body	Medium	CWE-294
fast-uri vulnerable to host confusion via percent-encoded authority delimiters fast-uri v3.1.1 and earlier decodes percent-encoded authority delimiters (%40 as @, %3A as :) inside the host component and serializes them back as raw characters....	High	CWE-436
nanoid: custom generators can loop indefinitely when size is zero nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0,...	High	CWE-835
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion @anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies —...	High	CWE-400
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits fast-xml-parser processes multiple “DOCTYPE” declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities().	High	CWE-776
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure File: lib/previous-map.jsLine: 87-98 (loadFile), 129-144 (loadMap)	High	CWE-22
Quasar: Prototype pollution in the extend() utility [email protected], the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the...	Medium	CWE-1321
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) Remote Code Execution (RCE) in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq (“Prototype Pollution in #set path assignment”)...	High	CWE-94
TypeORM: migration:generate template-literal code injection typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not ${...}. An attacker who can write schema metadata (column comments, defaults,...	Medium	CWE-94
fast-uri vulnerable to host confusion via failed IDN canonicalization fast-uri versions >= 2.3.1, <= 4.0.0 fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls URL.domainToASCII(...) on the global WHATWG URL...	High	CWE-551
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly.	High	CWE-407
Vulnerable Apache Version The Apache HTTP Server version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the server,...	Medium
Vulnerable Nginx Version The Nginx version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the server, leading to...	Medium
Vulnerable OpenSSL Version The OpenSSL version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the server, leading to...	Medium
Vulnerable PHP Version The PHP version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the server, leading to...	Medium
Vulnerable Tomcat Version The Apache Tomcat version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the server, leading...	Medium
Vulnerable WordPress Version The WordPress version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the website, leading to...	High

Supported Tests by SmartScanner

Get Started

Learn More

Cross-Site Scripting in dojo - dojo

Read the Docs vulnerable to Cross-Site Scripting (XSS)

Incorrect default cookie name and recommendation

Cross-Site Scripting in simditor

Cross-Site Scripting in bootbox

Reflected Cross-Site Scripting in jquery.terminal

Cross-Site Scripting in react-svg

Memory Exposure in tunnel-agent

Cross-Site Scripting in shave

Cross-Site Scripting in bracket-template

Prototype Pollution in deap

Denial of Service in canvas

Regular Expression Denial of Service

Path Traversal in localhost-now - localhost-now

Regular Expression Denial of Service - nwmatcher

Cross-Site Scripting in ids-enterprise - ids-enterprise

Cross-Site Scripting in ids-enterprise

Remote code execution in Handlebars.js

Sandbox Bypass Leading to Arbitrary Code Execution in constantinople

HTML tag injection

Insecure Default Configuration in tesseract.js

Prototype Pollution in lutils-merge

Prototype Pollution in upmerge

Failure to sanitize quotes which can lead to sql injection in squel

Regular Expression Denial of Service in underscore.string

Cross-Site Scripting in marked

Cross-Site Scripting (XSS) in cloudcmd

Denial of Service in url-relative

Content injection in marked

Command Injection in dot

Reverse Tabnapping in swagger-ui

Cross-Site Scripting in ids-enterprise - ids-enterprise - GHSA-crfx-5phg-hmw9

Cross-Site Scripting in @nuxt/devalue

Cross-Site Scripting via JSONP

Denial of Service in mem

Cross-Site Scripting in cyberchef

Cross-Site Scripting in dojo - dojo - GHSA-536q-8gxx-m782

Message Signature Bypass in openpgp

Prototype Pollution in deeply

Cross-Site Scripting in iobroker.web

Remote Code Execution in Angular Expressions

Validation bypass is possible in Json Pattern Validator

Cross-Site Scripting in selectize-plugin-a11y

Denial of Service in rgb2hex

Improper Key Verification in openpgp

Cross-Site Scripting in vant

Incorrect Account Used for Signing - eth-ledger-bridge-keyring

Incorrect Account Used for Signing

OS Command Injection in devcert-sanscache

Regular Expression Denial of Service in Acorn

Sandbox bypass in constantinople

Command Injection in hot-formula-parser

False-negative validation results in MINT transactions with invalid baton - slpjs

False-negative validation results in MINT transactions with invalid baton

discord-html not escaping HTML code blocks when lacking a language identifier

Downloads Resources over HTTP in rs-brightcove

Prototype Pollution in Dojox

XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode

Cross-Site Scripting in seeftl

XSS in TinyMCE

Holder can generate proof of ownership for credentials it does not control in vp-toolkit

Holder can (re)create authentic credentials after receiving a credential in vp-toolkit

Cross-Site Scripting in fileview

Cross-Site Scripting in sanitize-html - sanitize-html - GHSA-3j7m-hmh3-9jmp

Information disclosure through error object in auth0.js

Introspection in schema validation in Apollo Server

Validation Bypass in slp-validate

Resources Downloaded over Insecure Protocol in igniteui

Sandbox Breakout in realms-shim

Cross-Site Scripting in editor.md

Cross Site Scripting (XSS) in plotly.js

Missing Origin Validation in parcel-bundler - parcel-bundler

Denial of Service in nes

Critical severity vulnerability that affects slpjs

Downloads Resources over HTTP in jser-stat

Moderate severity vulnerability that affects validator - validator - GHSA-552w-rqg8-gxxm

Regular Expression Denial of Service in ssri