MediumCWE-79
Cross-Site Scripting in dojo - dojo
Versions of dojo prior to 1.2.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize HTML code in user-controlled input, allowing attackers to...
npmdojo
Read check Security libraryUpdated weekly
Know what your scanner is looking for.
Explore the security checks SmartScanner runs, from common web flaws to framework-specific weaknesses. Open any check for impact, remediation, and references.
2646 checks1928 CVEsOWASP and CWE mapped
Put the list to work
Find these vulnerabilities on your own website with a free scan.
Your scan runs on your computer. No account required.
Browse the checks
Vulnerability index
2646 checks found
Filter
MediumCWE-79
Read the Docs vulnerable to Cross-Site Scripting (XSS)
This vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that...
npmreadthedocs
Read check Low
Incorrect default cookie name and recommendation
The default cookie name (and documentation recommendation) was prefixed with Host__ instead of __Host-. The point of this prefix is for additional security, to ensure...
npmcsrf-csrf
Read check MediumCWE-79
Cross-Site Scripting in simditor
Versions of simditor prior to 2.3.22 are vulnerable to Cross-Site Scripting. The package does not sanitize user input that is rendered with innerHTML, allowing attackers...
npmsimditor
Read check MediumCWE-79
Cross-Site Scripting in bootbox
All version of bootbox are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject...
npmbootbox
Read check MediumCWE-79
Reflected Cross-Site Scripting in jquery.terminal
Versions of jquery.terminal prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options anyLinks or invokeMethods set to...
npmjquery.terminal
Read check HighCWE-79
Cross-Site Scripting in react-svg
Versions of react-svg before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run...
npmreact-svg
Read check MediumCWE-200
Memory Exposure in tunnel-agent
Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.
npmtunnel-agent
Read check MediumCWE-79
Cross-Site Scripting in shave
Versions of shave prior to 2.5.3 are vulnerable to Cross-Site Scripting. The shave package overwrites HTML elements and in doing so fails to properly encode...
npmshave
Read check HighCWE-79
Cross-Site Scripting in bracket-template
All versions of bracket-template are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used...
npmbracket-template
Read check HighCWE-400
Prototype Pollution in deap
Versions of deap before 1.0.1 are vulnerable to prototype pollution.
npmdeap
Read check Medium
Denial of Service in canvas
Versions of canvas prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.
npmcanvas
Read check Medium
Regular Expression Denial of Service
A flaw was found in nodejs-marked versions from 0.5.0 to before 0.6.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service...
npmmarked
Read check HighCWE-22
Path Traversal in localhost-now - localhost-now
All versions of localhost-now are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2
npmlocalhost-now
Read check MediumCWE-400
Regular Expression Denial of Service - nwmatcher
A Regular Expression vulnerability was found in nwmatcher before 1.4.4. The fix replacing multiple repeated instances of the “\s*” pattern.
npmnwmatcher
Read check HighCWE-79
Cross-Site Scripting in ids-enterprise - ids-enterprise
Versions of ids-enterprise prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The modal component fails to sanitize input to the title attribute, which may...
npmids-enterprise
Read check HighCWE-79
Cross-Site Scripting in ids-enterprise
Versions of ids-enterprise prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The soho-dropdown component does not properly encode its output and may allow attackers...
npmids-enterprise
Read check Medium
Remote code execution in Handlebars.js
Handlebars.js before 4.1.0 has Remote Code Execution (RCE)
npmhandlebars
Read check High
Sandbox Bypass Leading to Arbitrary Code Execution in constantinople
Versions of constantinople prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.
npmconstantinople
Read check Medium
HTML tag injection
Serve Handler, before 5.0.3, has a XSS via HTML tag injection in directory lisiting page.
npmserve-handler
Read check MediumCWE-829
Insecure Default Configuration in tesseract.js
Versions of tesseract.js prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through crossorigin.me which clearly states is not suitable for...
npmtesseract.js
Read check MediumCWE-400
Prototype Pollution in lutils-merge
All versions of lutils-merge are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object’s prototype, allowing attackers to...
npmlutils-merge
Read check MediumCWE-400
Prototype Pollution in upmerge
All versions of upmerge are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object’s prototype, allowing attackers to...
npmupmerge
Read check HighCWE-89
Failure to sanitize quotes which can lead to sql injection in squel
All versions of squel are vulnerable to sql injection.
npmsquel
Read check MediumCWE-400
Regular Expression Denial of Service in underscore.string
Versions of underscore.string prior to 3.3.5 are vulnerable to Regular Expression Denial of Service (ReDoS).
npmunderscore.string
Read check Medium
Cross-Site Scripting in marked
Versions 0.3.7 and earlier of marked unescape only lowercase while owsers support both lowercase and uppercase x in hexadecimal form of HTML character entity
npmmarked
Read check HighCWE-79
Cross-Site Scripting (XSS) in cloudcmd
Versions of cloudcmd before 9.1.6 are vulnerable to cross-site scripting (XSS) when listing files in a directory. The attacker must control the name of a...
npmcloudcmd
Read check MediumCWE-400
Denial of Service in url-relative
All versions of url-relative are vulnerable to Denial of Service. If the values to and from are equal, the function hangs and never returns. This...
npmurl-relative
Read check Medium
Content injection in marked
Versions 0.3.7 and earlier of marked When mangling is disabled via option mangle don’t escape target href. This allow attacker to inject arbitrary html-event into...
npmmarked
Read check MediumCWE-77
Command Injection in dot
All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template...
npmdot
Read check MediumCWE-1022
Reverse Tabnapping in swagger-ui
Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the...
npmswagger-ui
Read check HighCWE-79
Cross-Site Scripting in ids-enterprise - ids-enterprise - GHSA-crfx-5phg-hmw9
Versions of ids-enterprise prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the soho-autocomplete component are not properly encoded and may allow...
npmids-enterprise
Read check MediumCWE-79
Cross-Site Scripting in @nuxt/devalue
Versions of @nuxt/devalue prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys....
npm@nuxt/devalue
Read check MediumCWE-79
Cross-Site Scripting via JSONP
JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.
npmangular
Read check MediumCWE-400
Denial of Service in mem
Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). The package fails to remove old values from the cache even after...
npmmem
Read check MediumCWE-79
Cross-Site Scripting in cyberchef
Versions of cyberchef prior to 8.31.3 are vulnerable to Cross-Site Scripting. In Text Encoding Brute Force the table rows are created by concatenating the value...
npmcyberchef
Read check MediumCWE-79
Cross-Site Scripting in dojo - dojo - GHSA-536q-8gxx-m782
Versions of dojo prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the _testCommon.js and runner.html...
npmdojo
Read check HighCWE-347
Message Signature Bypass in openpgp
Versions of openpgp prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type text....
npmopenpgp
Read check HighCWE-400
Prototype Pollution in deeply
Versions of deeply prior to 1.0.1 are vulnerable to Prototype Pollution. The package fails to validate which Object properties it updates. This allows attackers to...
npmdeeply
Read check MediumCWE-79
Cross-Site Scripting in iobroker.web
Versions of iobroker.web prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server...
npmiobroker.web
Read check HighCWE-74
Remote Code Execution in Angular Expressions
The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input.
npmangular-expressions
Read check MediumCWE-287
Validation bypass is possible in Json Pattern Validator
In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated...
npmjpv
Read check MediumCWE-79
Cross-Site Scripting in selectize-plugin-a11y
Versions of selectize-plugin-a11y prior to 1.1.0 are vulnerable to Cross-Site Scripting. The accessibility.liveRegion.speak function does not sanitize the msg variable before rendering it as HTML....
npmselectize-plugin-a11y
Read check MediumCWE-400
Denial of Service in rgb2hex
All versions of rgb2hex are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value....
npmrgb2hex
Read check HighCWE-347
Improper Key Verification in openpgp
Versions of openpgp prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed...
npmopenpgp
Read check HighCWE-79
Cross-Site Scripting in vant
Versions of vant prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the Picker component column is not sanitized, which may allow...
npmvant
Read check HighCWE-287
Incorrect Account Used for Signing - eth-ledger-bridge-keyring
Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the...
npmeth-ledger-bridge-keyring
Read check HighCWE-287
Incorrect Account Used for Signing
Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the...
npm@metamask/eth-ledger-bridge-keyring
Read check HighCWE-78
OS Command Injection in devcert-sanscache
devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable commonName controlled by user...
npmdevcert-sanscache
Read check HighCWE-400
Regular Expression Denial of Service in Acorn
Affected versions of acorn are vulnerable to Regular Expression Denial of Service.A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite...
npmacorn
Read check Medium
Sandbox bypass in constantinople
constantinople before 3.1.1 affected by a sandbox bypass.
npmconstantinople
Read check HighCWE-94
Command Injection in hot-formula-parser
Versions of hot-formula-parser prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the parse function and concatenates it...
npmhot-formula-parser
Read check HighCWE-697
False-negative validation results in MINT transactions with invalid baton - slpjs
Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result...
npmslpjs
Read check HighCWE-697
False-negative validation results in MINT transactions with invalid baton
Users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result...
npmslp-validate
Read check High
discord-html not escaping HTML code blocks when lacking a language identifier
Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.
npmdiscord-markdown
Read check HighCWE-311
Downloads Resources over HTTP in rs-brightcove
Affected versions of rs-brightcove insecurely download an executable over an unencrypted HTTP connection.
npmrs-brightcove
Read check LowCWE-94
Prototype Pollution in Dojox
The Dojox jQuery wrapper jqMix mixin method is vulnerable to Prototype Pollution.
npmdojox
Read check MediumCWE-79
XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode
Potential XSS vulnerability for users of dojox/xmpp and dojox/dtl.
npmdojox
Read check HighCWE-79
Cross-Site Scripting in seeftl
All versions of seeftl are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim’s...
npmseeftl
Read check MediumCWE-79
XSS in TinyMCE
A cross-site scripting (XSS) vulnerability was discovered in: the core parser and media plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted...
npmtinymce
Read check High
Holder can generate proof of ownership for credentials it does not control in vp-toolkit
The verifyVerifiablePresentation() method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the credentialSubject.id DID matches the signer of the...
npmvp-toolkit
Read check High
Holder can (re)create authentic credentials after receiving a credential in vp-toolkit
The verifyVerifiableCredential() method check the cryptographic integrity of the Verifiable Credential, but it does not check if the credential.issuer DID matches the signer of the...
npmvp-toolkit
Read check HighCWE-79
Cross-Site Scripting in fileview
All versions of fileview are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim’s...
npmfileview
Read check MediumCWE-79
Cross-Site Scripting in sanitize-html - sanitize-html - GHSA-3j7m-hmh3-9jmp
Affected versions of sanitize-html do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript.
npmsanitize-html
Read check HighCWE-522
Information disclosure through error object in auth0.js
Between versions 8.0.0 and 9.13.1(inclusive), in the case of an (authentication) error, the error object returned by the library contains the original request of the...
npmauth0-js
Read check Medium
Introspection in schema validation in Apollo Server
We encourage all users of Apollo Server to read this advisory in its entirety to understand the impact. The Resolution section contains details on patched...
npmapollo-server-cloudflare
Read check HighCWE-20
Validation Bypass in slp-validate
Versions of slp-validate prior to 1.0.1 are vulnerable to a validation bypass. Bitcoin scripts may cause the validation result from slp-validate to differ from the...
npmslp-validate
Read check LowCWE-311
Resources Downloaded over Insecure Protocol in igniteui
Affected versions of igniteui download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view...
npmigniteui
Read check High
Sandbox Breakout in realms-shim
Versions of realms-shim prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the...
npmrealms-shim
Read check MediumCWE-79
Cross-Site Scripting in editor.md
All versions of editor.md are vulnerable to Cross-Site Scripting. User input is insufficiently sanitized, allowing attackers to inject malicious code in payloads containing base64-encoded content....
npmeditor.md
Read check MediumCWE-79
Cross Site Scripting (XSS) in plotly.js
Affected versions of plotly.js are vulnerable to cross-site scripting if an attacker can convince a user to visit a malicious plot on a site using...
npmplotly.js
Read check HighCWE-200
Missing Origin Validation in parcel-bundler - parcel-bundler
Versions of parcel-bundler before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer’s source code...
npmparcel-bundler
Read check HighCWE-400
Denial of Service in nes
Affected versions of nes are vulnerable to denial of service when given an invalid cookie header, and websocket authentication is set to cookie. Submitting an...
npmnes
Read check HighCWE-20
Critical severity vulnerability that affects slpjs
No description available.
npmslpjs
Read check MediumCWE-311
Downloads Resources over HTTP in jser-stat
Affected versions of jser-stat insecurely downloads resources over HTTP.
npmjser-stat
Read check MediumCWE-79
Moderate severity vulnerability that affects validator - validator - GHSA-552w-rqg8-gxxm
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.
npmvalidator
Read check MediumCWE-400
Regular Expression Denial of Service in ssri
Version of ssri prior to 5.2.2 are vulnerable to regular expression denial of service (ReDoS) when using strict mode.
npmssri
Read check High
Sandbox Breakout in realms-shim - realms-shim
Versions of realms-shim prior to 1.2.0 are vulnerable to a Sandbox Breakout. Reflect.construct can be used on the sandboxed Function constructor to reach the prototypes...
npmrealms-shim
Read check High
Default Express middleware security check is ignored in production
No description available.
npm@cubejs-backend/api-gateway
Read check MediumCWE-79
XSS Filter Bypass via Encoded URL in validator
Versions of validator prior to 2.0.0 contained an xss filter method that is affected by several filter bypasses. This may result in a cross-site scripting...
npmvalidator
Read check MediumCWE-79
Cross-Site Scripting in nunjucks
Affected versions of nunjucks do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability....
npmnunjucks
Read check MediumCWE-79
Cross-Site Scripting in handlebars
Versions of handlebars prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted.
npmhandlebars
Read check HighCWE-94
Arbitrary Code Injection in pouchdb
Affected versions of pouchdb do not properly sandbox the code execution engine which executes the map/reduce functions for temporary views and design documents. Under certain...
npmpouchdb
Read check HighCWE-22
High severity vulnerability that affects gun
The static file server module included with GUN had a serious vulnerability:
npmgun
Read check MediumCWE-79
VBScript Content Injection in marked
Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.
npmmarked
Read check Medium
Moderate severity vulnerability that affects marked
This advisory has been withdrawn, per NVD: “This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue.”
npmmarked
Read check HighCWE-20
Prototype Pollution in async merge-object
The utilities function in all versions of the merge-object node module can be tricked into modifying the prototype of Object when the attacker can control...
npmmerge-object
Read check MediumCWE-79
Cross-Site Scripting in serialize-javascript
Versions of serialize-javascript prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect...
npmserialize-javascript
Read check Low
Low severity vulnerability that affects eye.js
No description available.
npmeye.js
Read check HighCWE-311
Downloads Resources over HTTP in strider-sauce
Affected versions of strider-sauce insecurely download an executable over an unencrypted HTTP connection.
npmstrider-sauce
Read check HighCWE-20
Prototype Pollution in merge-options
All versions of merge-options are vulnerable to Prototype Pollution
npmmerge-options
Read check HighCWE-311
Downloads Resources over HTTP in openframe-glslviewer
Affected versions of openframe-glslviewer insecurely download an executable over an unencrypted HTTP connection.
npmopenframe-glslviewer
Read check HighCWE-311
Downloads Resources over HTTP in product-monitor
Affected versions of product-monitor insecurely download an executable over an unencrypted HTTP connection.
npmproduct-monitor
Read check MediumCWE-79
Multiple XSS Filter Bypasses in validator
Versions of validator prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the blacklist-based filter.
npmvalidator
Read check HighCWE-400
ReDoS via long UserAgent header in ua-parser
Affected versions of ua-parser are vulnerable to regular expression denial of service when given a specially crafted User-Agent header.
npmua-parser
Read check HighCWE-79
Cross-Site Scripting in mustache
Versions of mustache prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted.
npmmustache
Read check HighCWE-400
Regular Expression Denial of Service in parsejson
Affected versions of parsejson are vulnerable to a regular expression denial of service when parsing untrusted user input.
npmparsejson
Read check HighCWE-22
Path Traversal in socket.io-file
All versions of socket.io-file are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths....
npmsocket.io-file
Read check HighCWE-400
Regular expression denial of service in url-regex
all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial...
npmurl-regex
Read check MediumCWE-362
ECDSA signature vulnerability of Minerva timing attack in jsrsasign
ECDSA side-channel attack named Minerava have been found and it was found that it affects to jsrsasign.
npmjsrsasign
Read check HighCWE-79
Stored XSS in TimelineJS3
TimelineJS renders some user data as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This...
npm@knight-lab/timelinejs
Read check MediumCWE-256
Storing Password in Local Storage
The setPassword method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user’s password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe...
npmparse
Read check HighCWE-434
Unrestricted Upload of File with Dangerous Type in blueimp-file-upload
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
npmblueimp-file-upload
Read check HighCWE-79
Cross-Site Scripting in @progress/kendo-angular-editor
Kendo UI for Angular Editor Component (npm package @progress/kendo-angular-editor) before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts...
npm@progress/kendo-angular-editor
Read check HighCWE-697
False-positive validity for NFT1 genesis transactions in SLPJS
In the npm package named “slpjs”, versions prior to 0.27.4 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type.
npmslpjs
Read check HighCWE-79
Cross-Site Scripting in bootstrap-tagsinput
All versions of bootstrap-tagsinput are vulnerable to cross-site scripting when user input is passed into the itemTitle parameter unmodified, as the package fails to properly...
npmbootstrap-tagsinput
Read check HighCWE-79
Cross-Site Scripting in jqtree
Affected versions of jqtree are vulnerable to cross-site scripting in the drag and drop functionality for modifying tree data.
npmjqtree
Read check HighCWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-p239-93f7-h6xf
Affected versions of swagger-ui contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document.
npmswagger-ui
Read check HighCWE-79
Cross-Site Scripting (XSS) in pivottable
Affected versions of pivottable are vulnerable to cross-site scripting, due to a new mechanism used to render JSON elements.
npmpivottable
Read check LowCWE-79
DOM-based XSS in auth0-lock
Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection.
npmauth0-lock
Read check MediumCWE-79
Multiple Content Injection Vulnerabilities in marked
Versions 0.3.0 and earlier of marked are affected by two cross-site scripting vulnerabilities, even when sanitize: true is set.
npmmarked
Read check HighCWE-287
Authentication Bypass in console-io
Affected versions of the console-io package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As console-io allows...
npmconsole-io
Read check HighCWE-330
Insecure randomness in socket.io
Affected versions of socket.io depend on Math.random() to create socket IDs, and therefore the IDs are predictable. With enough information on prior IDs, an attacker...
npmsocket.io
Read check MediumCWE-79
Moderate severity vulnerability that affects validator
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.
npmvalidator
Read check HighCWE-682
Sensitive Data Exposure in msrcrypto
Versions of msrcrypto prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package’s Elliptic Curve Cryptography (ECC) implementation may leak information about a server’s...
npmmsrcrypto
Read check HighCWE-311
Downloads Resources over HTTP in js-given
Affected versions of js-given insecurely download an executable over an unencrypted HTTP connection.
npmjs-given
Read check MediumCWE-79
Moderate severity vulnerability that affects validator - validator
The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.
npmvalidator
Read check MediumCWE-77
Command Injection in wxchangba
All versions of wxchangba are vulnerable to Command Injection. The package does not validate user input on the reqPostMaterial function, passing contents of the file...
npmwxchangba
Read check MediumCWE-79
Cross-Site Scripting in @berslucas/liljs
Versions of @berslucas/liljs prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe innerHTML function without sanitizing input, which may allow...
npm@berslucas/liljs
Read check HighCWE-506
Malicious Package in rpc-websocket
Versions of rpc-websocket >= 0.7.6 contained malicious code. The package opens a backdoor to a remote server and executes arbitrary commands, effectively acting as a...
npmrpc-websocket
Read check HighCWE-94
Arbitrary Code Execution in mathjs - mathjs
math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary...
npmmathjs
Read check HighCWE-352
Auth0-js bypasses CSRF checks
The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it’s...
npmauth0-js
Read check HighCWE-697
False-positive validity for NFT1 genesis transactions
In the npm package named “slp-validate”, versions prior to 1.2.2 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type.
npmslp-validate
Read check MediumCWE-79
XSS via JQLite DOM manipulation functions in AngularJS
XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new...
npmangular
Read check HighCWE-77
Command Injection in ungit - ungit
Versions of ungit prior to 0.9.0 are affected by a command injection vulnerability in the url parameter.
npmungit
Read check HighCWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-7f59-x49p-v8mq
Affected versions of swagger-ui are vulnerable to cross-site scripting in both the consumes and produces parameters of the swagger JSON document for a given API....
npmswagger-ui
Read check HighCWE-79
Cross-Site Scripting in mrk.js
Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.
npmmrk.js
Read check HighCWE-79
Cross-Site Scripting in react-marked-markdown
All versions of react-marked-markdown are vulnerable to cross-site scripting (XSS) via href attributes. This is exploitable if user is provided to react-marked-markdown
npmreact-marked-markdown
Read check HighCWE-119
Denial of Service in ethereumjs-vm
ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a “code: Buffer.from(my_code, ‘hex’)” attribute.
npmethereumjs-vm
Read check HighCWE-506
Malicious Package in angular-material-sidenav-rnd
Version 0.1.1 of angular-material-sidenav-rnd contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmangular-material-sidenav-rnd
Read check HighCWE-506
Malicious Package in cordova-plugin-china-picker
Version 1.0.910 of cordova-plugin-china-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmcordova-plugin-china-picker
Read check HighCWE-94
Arbitrary JavaScript Execution in typed-function
Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute...
npmtyped-function
Read check HighCWE-79
Cross-Site Scripting in semantic-ui-search
All versions of semantic-ui-search are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead...
npmsemantic-ui-search
Read check MediumCWE-74
HTML Injection in preact
Versions of preact 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package...
npmpreact
Read check HighCWE-79
Cross-Site Scripting in cmmn-js-properties-panel
Versions of cmmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow...
npmcmmn-js-properties-panel
Read check HighCWE-1321
Prototype Pollution in lodash.defaultsdeep - lodash.defaultsdeep
Versions of lodash.defaultsdeep before 4.6.1 are vulnerable to prototype pollution. The function mergeWith may allow a malicious user to modify the prototype of Object via...
npmlodash.defaultsdeep
Read check HighCWE-77
Command Injection in marsdb
All versions of marsdb are vulnerable to Command Injection. In the DocumentMatcher class, selectors on $where clauses are passed to a Function constructor unsanitized. This...
npmmarsdb
Read check HighCWE-79
Cross-Site Scripting in fomantic-ui
Versions of fomantic-ui are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of...
npmfomantic-ui
Read check MediumCWE-79
Cross-Site Scripting in google-closure-library
Versions of google-closure-library prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The safedomtreeprocessor.processToString() function improperly processed empty elements, which could allow attackers to execute arbitrary...
npmgoogle-closure-library
Read check HighCWE-79
Cross-Site Scripting in hexo-admin
All versions of hexo-admin are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a...
npmhexo-admin
Read check MediumCWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-388g-jwpg-x6j4
Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This...
npmswagger-ui
Read check MediumCWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-vp93-gcx5-4w52
Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript...
npmswagger-ui
Read check MediumCWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-w992-2gmj-9xxj
Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the swagger.apiInfo.description value without proper sanitization, which...
npmswagger-ui
Read check HighCWE-79
DOM-based XSS in gmail-js
Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parse_response, helper.get.visible_emails_post, and helper.get.email_data_post functions, which pass user input directly into the Function constructor....
npmgmail-js
Read check LowCWE-682
Incorrect Calculation in bigint-money
Versions of bigint-money prior to 0.6.2 are vulnerable to an Incorrect Calculation. The package incorrectly rounded certain numbers, which could have drastic consequences due to...
npmbigint-money
Read check HighCWE-506
Malicious Package in bmap
Version 1.0.3 of bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmbmap
Read check HighCWE-400
Regular Expression Denial of Service in ansi2html
The ansi2html package is affected by a regular expression denial of service vulnerability when certain types of user input is passed in.
npmansi2html
Read check HighCWE-400
Regular Expression Denial of Service in validator
Versions of validator prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the isURL method.
npmvalidator
Read check MediumCWE-1022
Reverse Tabnabbing in quill
Versions of quill prior to 1.3.7 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the...
npmquill
Read check MediumCWE-346
User Impersonation in converse.js
Versions of converse.js prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of XEP-0280:...
npmconverse.js
Read check HighCWE-79
XSS in client rendered block templates in rendr
Affected versions of rendr are vulnerable to cross-site scripting when client side rendering is done inside a _block.
npmrendr
Read check MediumCWE-400
Denial of Service in handlebars
Affected versions of handlebars are vulnerable to Denial of Service. The package’s parser may be forced into an endless loop while processing specially-crafted templates. This...
npmhandlebars
Read check HighCWE-1321
Prototype Pollution in sahmat
All versions of sahmat are vulnerable to prototype pollution. The package does not restrict the modification of an Object’s prototype, which may allow an attacker...
npmsahmat
Read check HighCWE-79
Cross-Site Scripting in atlasboard-atlassian-package
All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize user input that is rendered as...
npmatlasboard-atlassian-package
Read check HighCWE-79
Cross-Site Scripting in bootstrap-select - bootstrap-select
Versions of bootstrap-select prior to 1.13.6 are vulnerable to Cross-Site Scripting (XSS). The package does not escape title values on <option> tags. This may allow...
npmbootstrap-select
Read check HighCWE-79
HTML Injection in marky-markdown - marky-markdown
All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may...
npmmarky-markdown
Read check HighCWE-285
Improper Authorization in react-oauth-flow
All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth...
npmreact-oauth-flow
Read check HighCWE-285
Improper Authorization in @sap-cloud-sdk/core
Affected versions of @sap-cloud-sdk/core do not properly validate JWTs. The verifyJwt() function does not properly validate the URL from where the public verification key for...
npm@sap-cloud-sdk/core
Read check HighCWE-79
Cross-Site Scripting in mermaid - mermaid
Versions of mermaid prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as A["<img src=invalid onerror=alert('XSS')></img>"] is provided to the application, it...
npmmermaid
Read check High
Denial of Service in serialize-to-js
Versions of serialize-to-js prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead...
npmserialize-to-js
Read check HighCWE-200
Missing Origin Validation in browserify-hmr
Versions of browserify-hmr prior to 0.4.0 are missing origin validation on the websocket server.
npmbrowserify-hmr
Read check MediumCWE-1321
Prototype Pollution in smart-extend
All versions of smart-extend are vulnerable to Prototype Pollution. The deep() function allows attackers to modify the prototype of Object causing the addition or modification...
npmsmart-extend
Read check HighCWE-77
Command Injection in soletta-dev-app
All versions of soletta-dev-app are vulnerable to Command Injection. The package does not validate user input on the /api/service/status API endpoint, passing contents of the...
npmsoletta-dev-app
Read check HighCWE-506
Malicious Package in react-datepicker-plus
Versions 2.4.3 and 2.4.2 of react-datepicker-plus contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms...
npmreact-datepicker-plus
Read check HighCWE-506
Malicious Package in vue-backbone
Version 0.1.2 of vue-backbone contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmvue-backbone
Read check MediumCWE-79
Cross-Site Scripting in diagram-js-direct-editing
Versions of diagram-js-direct-editing prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary...
npmdiagram-js-direct-editing
Read check HighCWE-79
Cross-Site Scripting in graylog-web-interface
All versions of graylog-web-interface are vulnerable to Cross-Site Scripting (XSS). The package fails to escape output on the TypeAhead and QueryInput components, which may allow...
npmgraylog-web-interface
Read check HighCWE-79
Cross-Site Scripting in @ionic/core
Versions of @ionic/core prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe innerHTML function without sanitizing...
npm@ionic/core
Read check HighCWE-79
Cross-Site Scripting in jquery.json-viewer - jquery.json-viewer
Versions of jquery.json-viewer prior to 1.3.0 are vulnerable to Cross-Site Scripting (XSS). The package insufficiently sanitizes user input when creating links, and concatenates the user...
npmjquery.json-viewer
Read check HighCWE-22
Path Traversal in zero
Versions of zero prior to 1.0.6 are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using...
npmzero
Read check HighCWE-79
Cross-Site Scripting in dmn-js-properties-panel
Versions of dmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow...
npmdmn-js-properties-panel
Read check HighCWE-79
Cross-Site Scripting in Prism - prismjs
The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer.
npmprismjs
Read check HighCWE-1321
Prototype Pollution in lodash.merge
Versions of lodash.merge before 4.6.1 are vulnerable to Prototype Pollution. The function ‘merge’ may allow a malicious user to modify the prototype of Object via...
npmlodash.merge
Read check HighCWE-79
Cross-Site Scripting in snekserve
All versions of snekserve are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim’s...
npmsnekserve
Read check MediumCWE-352
CSRF Vulnerability in jquery-ujs
Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers...
npmjquery-ujs
Read check MediumCWE-79
Cross-Site Scripting in yui
Affected versions of yui are vulnerable to cross-site scripting in the uploader.swf and io.swf utilities, via script injection in the url.
npmyui
Read check HighCWE-22
Arbitrary File Write in iobroker.admin
Versions of iobroker.admin prior to 3.6.12 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended folder in...
npmiobroker.admin
Read check HighCWE-1321
Prototype Pollution in get-setter
All versions of get-setter are vulnerable to prototype pollution. The function set does not restrict the modification of an Object’s prototype, which may allow an...
npmget-setter
Read check HighCWE-1321
Prototype Pollution in getsetdeep
All versions of getsetdeep are vulnerable to prototype pollution. The setDeep() function does not restrict the modification of an Object’s prototype, which may allow an...
npmgetsetdeep
Read check HighCWE-1321
Prototype Pollution in handlebars - handlebars - GHSA-g9r4-xpmj-mj65
Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype...
npmhandlebars
Read check HighCWE-506
Malicious Package in awesome_react_utility
Version 1.0.2 of awesome_react_utility contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmawesome_react_utility
Read check HighCWE-506
Malicious Package in codify
Version 0.3.1 of codify contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmcodify
Read check HighCWE-506
Malicious Package in json-serializer - json-serializer
Version 2.0.10 of json-serializer contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmjson-serializer
Read check LowCWE-77
Command Injection in ascii-art
Versions of ascii-art before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the ascii-art preview...
npmascii-art
Read check HighCWE-79
Cross-Site Scripting in buefy
Versions of buefy prior to 0.7.2 are vulnerable to Cross-Site Scripting, allowing attackers to manipulate the DOM and execute remote code. The autocomplete list renders...
npmbuefy
Read check HighCWE-79
Cross-Site Scripting in markdown-it-katex
All versions of markdown-it-katex are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary...
npmmarkdown-it-katex
Read check HighCWE-79
Cross-Site Scripting in md-data-table
All versions of md-data-table are vulnerable to cross-site scripting (XSS). This vulnerability is exploitable if an attacker has control over data that is rendered by...
npmmd-data-table
Read check MediumCWE-79
HTML Injection in marky-markdown
All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but...
npmmarky-markdown
Read check HighCWE-327
Insecure Cryptography Algorithm in parsel
All versions of parsel use an insecure cryptography algorithm. The package uses aes-256-cbc without integrity checks, which renders the ciphertext vulnerable to bit-flipping attacks.
npmparsel
Read check HighCWE-331
Insufficient Entropy in parsel
All versions of parsel use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key...
npmparsel
Read check HighCWE-79
Cross-Site Scripting in htmr
Versions of htmr prior to 0.8.7 are vulnerable to Cross-Site Scripting (XSS). The package uses innerHTML to unescape HTML entities. This may lead to DOM-based...
npmhtmr
Read check HighCWE-79
Cross-Site Scripting in wangeditor
All versions of wangeditor are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and...
npmwangeditor
Read check HighCWE-352
Cross-Site Request Forgery (CSRF) in Auth0
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
npmauth0-js
Read check HighCWE-506
Malicious Package in motiv.scss
Version 0.4.20 of motiv.scss contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmmotiv.scss
Read check MediumCWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-22q9-hqm5-mhmc
Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to encode output in GET requests.
npmswagger-ui
Read check HighCWE-506
Malicious Package in zemen
Version 0.0.5 of zemen contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmzemen
Read check HighCWE-22
Path Traversal in ponse
Versions of ponse prior to 2.0.2 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of...
npmponse
Read check HighCWE-1321
Prototype Pollution in lodash.defaultsdeep
Versions of lodash.defaultsdeep before 4.6.1 are vulnerable to Prototype Pollution. The function ‘defaultsDeep’ may allow a malicious user to modify the prototype of Object via...
npmlodash.defaultsdeep
Read check MediumCWE-1321
Prototype Pollution in mergify
All versions of mergify are vulnerable to Prototype Pollution. The mergify() function allows attackers to modify the prototype of Object causing the addition or modification...
npmmergify
Read check HighCWE-1321
Prototype Pollution in mithril
Affected versions of mithrilare vulnerable to prototype pollution. The function parseQueryString may allow a malicious user to modify the prototype of Object, causing the addition...
npmmithril
Read check HighCWE-200
Unauthorized File Access in atompm
Versions of atompm prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads,...
npmatompm
Read check Medium
Configuration Override in helmet-csp
Versions of helmet-csp before to 2.9.1 are vulnerable to a Configuration Override affecting the application’s Content Security Policy (CSP). The package’s browser sniffing for Firefox...
npmhelmet-csp
Read check HighCWE-79
Cross-Site Scripting in eco
All versions of eco are vulnerable to Cross-Site Scripting (XSS). The package’s default __escape implementation fails to escape single quotes, which may allow attackers to...
npmeco
Read check MediumCWE-400
ReDOS vulnerabities: multiple grammars - highlight.js
oswasp:
npmhighlight.js
Read check MediumCWE-400
ReDOS vulnerabities: multiple grammars
oswasp:
npm@highlightjs/cdn-assets
Read check High
Sandbox Breakout / Arbitrary Code Execution in safer-eval - safer-eval - GHSA-876r-hj45-fw7g
All versions of safer-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively...
npmsafer-eval
Read check HighCWE-79
Cross-Site Scripting in react
Versions of react prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package’s createElement function fails to properly validate its input object, allowing attackers...
npmreact
Read check HighCWE-1321
Prototype Pollution in flat-wrap
All versions of flat-wrap are vulnerable to prototype pollution. The function unflatten does not restrict the modification of an Object’s prototype, which may allow an...
npmflat-wrap
Read check HighCWE-1321
Prototype Pollution in safe-object2 - safe-object2
All versions of safe-object2 are vulnerable to prototype pollution. The settter() function does not restrict the modification of an Object’s prototype, which may allow an...
npmsafe-object2
Read check HighCWE-1321
Prototype Pollution in unflatten
All versions of unflatten are vulnerable to prototype pollution. The function unflatten does not restrict the modification of an Object’s prototype, which may allow an...
npmunflatten
Read check HighCWE-522
Client TLS credentials sent raw to server in npm package nats
Nats is a Node.js client for the NATS messaging system.
npmnats
Read check HighCWE-79
Cross-Site Scripting in ngx-md
Versions of ngx-md prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead...
npmngx-md
Read check HighCWE-22
Path Traversal in sapper
Versions of sapper prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing...
npmsapper
Read check MediumCWE-79
Potential XSS in jQuery dependency in Mirador
Mirador users less than v3.0.0 (alpha-rc) versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be...
npmmirador
Read check HighCWE-471
Prototype Pollution in json-logic-js
Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through...
npmjson-logic-js
Read check HighCWE-434
Unrestricted Upload of File with Dangerous Type in jquery-file-upload
Arbitrary file upload in jQuery Upload File <= 4.0.2
npmjquery-file-upload
Read check HighCWE-287
Authentication Bypass in otpauth
Versions of otpauth prior to 3.2.8 are vulnerable to Authentication Bypass. The package’s totp.validate() function may return positive values for single digit tokens even if...
npmotpauth
Read check HighCWE-79
Cross-Site Scripting in console-feed
Versions of console-feed prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses...
npmconsole-feed
Read check HighCWE-506
Malicious Package in rate-map
Version 1.0.3 of rate-map contains malicious code. The malware breaks functionality of the purescript-installer package by rewriting code of the dl-tar dependency.
npmrate-map
Read check HighCWE-1321
Prototype Pollution in lodash.merge - lodash.merge
Versions of lodash.merge before 4.6.2 are vulnerable to prototype pollution. The function merge may allow a malicious user to modify the prototype of Object via...
npmlodash.merge
Read check HighCWE-1321
Prototype Pollution in lodash.mergewith - lodash.mergewith
Versions of lodash.mergewith before 4.6.1 are vulnerable to Prototype Pollution. The function ‘mergeWith’ may allow a malicious user to modify the prototype of Object via...
npmlodash.mergewith
Read check HighCWE-1321
Prototype Pollution in lodash.mergewith
Versions of lodash.mergewith before 4.6.2 are vulnerable to prototype pollution. The function mergeWith may allow a malicious user to modify the prototype of Object via...
npmlodash.mergewith
Read check MediumCWE-79
Cross-Site Scripting in mavon-editor
All versions of mavon-editor are vulnerable to Cross-Site Scripting. The package fails to sanitize entered input, allowing attackers to execute arbitrary JavaScript in a victim’s...
npmmavon-editor
Read check High
Malicious Package in json-serializer
Version 2.0.10 of json-serializer contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmjson-serializer
Read check HighCWE-79
Cross-Site Scripting in markdown-to-jsx - markdown-to-jsx
Versions of markdown-to-jsx prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This...
npmmarkdown-to-jsx
Read check High
Machine-In-The-Middle in airtable
Affected versions of airtable are vulnerable to Machine-In-The-Middle. The package has SSL certificate validation disabled by default unintentionally. This may allow attackers in a privileged...
npmairtable
Read check High
Arbitrary Code Execution in handlebars - handlebars - GHSA-q2c6-c6pm-g3gh
Versions of handlebars prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package’s lookup helper fails to properly validate templates, allowing attackers...
npmhandlebars
Read check LowCWE-400
Regular Expression Denial of Service in markdown
All versions of markdown are vulnerable to Regular Expression Denial of Service (ReDoS). The markdown.toHTML() function has significantly degraded performance when parsing long strings containing...
npmmarkdown
Read check HighCWE-79
Cross-Site Scripting in nextcloud-vue-collections
Versions of nextcloud-vue-collections prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to...
npmnextcloud-vue-collections
Read check MediumCWE-1104
Outdated Static Dependency in vue-moment
Versions of vue-moment prior to 4.1.0 contain an Outdated Static Dependency. The package depends on moment and has it loaded statically instead of as a...
npmvue-moment
Read check LowCWE-400
Regex denial of service vulnerability in codesample plugin
A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the codesample plugin. The vulnerability allowed poorly formed ruby code samples to...
npmtinymce
Read check MediumCWE-347
Signatures are mistakenly recognized to be valid in jsrsasign
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known...
npmjsrsasign
Read check High
Hardcoded Initialization Vector in parsel
All versions of parsel have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV...
npmparsel
Read check HighCWE-918
Server-Side Request Forgery in @uppy/companion - @uppy/companion
Versions of @uppy/companion prior to 1.9.3 are vulnerable to Server-Side Request Forgery (SSRF). The get route passes the user-controlled variable req.body.url to a GET request...
npm@uppy/companion
Read check MediumCWE-290
Verification flaw in Solid identity-token-verifier
No description available.
npm@solid/identity-token-verifier
Read check HighCWE-1321
Improperly Controlled Modification of Object Prototype Attributes
The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not...
npmthink-config
Read check MediumCWE-79
Cross-site scripting vulnerability in TinyMCE - tinymce - GHSA-5vm8-hhgr-jcjp
A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser for form elements. The vulnerability allowed arbitrary JavaScript execution...
npmtinymce
Read check MediumCWE-347
Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript
This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages.
npm@aws-crypto/client-browser
Read check MediumCWE-400
Regular Expression Denial of Service in millisecond
Versions of millisecond prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
npmmillisecond
Read check High
Execution with Unnecessary Privileges in arc-electron
When the end-user click on the response header that contains a link the target will be opened in ARC new window.
npm@advanced-rest-client/base
Read check High
Removal of functional code in faker.js
Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to...
npmfaker
Read check MediumCWE-1333
Inefficient Regular Expression Complexity in Validator.js - validator
Versions of validator prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the rtrim and trim sanitizers.
npmvalidator
Read check MediumCWE-400
Marked ReDoS due to email addresses being evaluated in quadratic time
Versions of marked from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers...
npmmarked
Read check HighCWE-79
fuelux vulnerable to Cross-Site Scripting in Pillbox feature
Affected versions of fuelux contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it...
npmfuelux
Read check MediumCWE-79
Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript
Versions of pannellum prior to 2.5.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs for data URIs, which may allow attackers...
npmpannellum
Read check MediumCWE-362
cookie-signature Timing Attack
Affected versions of cookie-signature are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison.
npmcookie-signature
Read check Medium
Path traversal for local publishers in TechDocs backend
A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend...
npm@backstage/techdocs-common
Read check HighCWE-78
Arbitrary Code Execution in require-node
Versions of require-node prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to...
npmrequire-node
Read check MediumCWE-400
Regular Expression Denial of Service in slug
Affected versions of slug are vulnerable to a regular expression denial of service when parsing untrusted user input.
npmslug
Read check MediumCWE-319
Cleartext Transmission of Sensitive Information in moment-timezone
No description available.
npmmoment-timezone
Read check Low
Command Injection in moment-timezone
All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection.
npmmoment-timezone
Read check HighCWE-79
gatsby-transformer-remark has possible unsanitized JavaScript code injection
The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its...
npmgatsby-transformer-remark
Read check LowCWE-843
Cross-site Scripting in bootstrap-table - bootstrap-table
This affects all versions of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the...
npmbootstrap-table
Read check HighCWE-918
RSSHub SSRF vulnerability
RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers...
npmrsshub
Read check High
Prototype Pollution in chartkick
Affected versions of @polymer/polymer are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such...
npmchartkick
Read check MediumCWE-20
Improper Input Validation in url-js
The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be...
npmurl-js
Read check MediumCWE-1021
Spoofing attack in swagger-ui-dist
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to...
npmswagger-ui-dist
Read check MediumCWE-287
Sudden swap of user auth tokens in Volto
Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that...
npm@plone/volto
Read check MediumCWE-79
Cross-site Scripting in sanitize-url
The package @braintree/sanitize-url before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the sanitizeUrl function.
npm@braintree/sanitize-url
Read check HighCWE-918
Server-Side Request Forgery in FUXA
A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server’s internal environment...
npm@frangoteam/fuxa
Read check HighCWE-77
Command injection in launchpad
All versions of package launchpad are vulnerable to Command Injection via stop.
npmlaunchpad
Read check MediumCWE-915
yargs-parser Vulnerable to Prototype Pollution
Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the...
npmyargs-parser
Read check HighCWE-915
Prototype Pollution in algoliasearch-helper
The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties....
npmalgoliasearch-helper
Read check MediumCWE-79
Cross-site Scripting in CKEditor4
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.
npmckeditor4
Read check HighCWE-915
Prototype Pollution in mathjs
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
npmmathjs
Read check HighCWE-1321
Prototype Pollution in mout - mout
This affects all versions of package mout. The deepFillIn function can be used to ‘fill missing properties recursively’, while the deepMixIn ‘mixes objects into the...
npmmout
Read check HighCWE-1321
Prototype Pollution in set-in
The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it....
npmset-in
Read check HighCWE-915
Prototype pollution vulnerability in js-extend
Prototype pollution vulnerability in ‘js-extend’ versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
npmjs-extend
Read check HighCWE-347
Failure to validate signature during handshake
@chainsafe/libp2p-noise before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process.This may allow a man-in-the-middle to pose as other peers and get...
npm@chainsafe/libp2p-noise
Read check HighCWE-79
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
The vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4.
npmckeditor4
Read check HighCWE-770
modern-async's `forEachSeries` and `forEachLimit` functions do not limit the number of requests
This is a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in...
npmmodern-async
Read check HighCWE-915
Prototype Pollution in ts-nodash
ts-nodash before version 1.2.7 is vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
npmts-nodash
Read check MediumCWE-347
Utils.readChallengeTx does not verify the server account signature
The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that...
npmstellar-sdk
Read check HighCWE-1321
Prototype Pollution in libnested
The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. Note: This vulnerability derives from an incomplete fix for...
npmlibnested
Read check HighCWE-77
Command Injection in ungit
The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled...
npmungit
Read check HighCWE-1321
Prototype pollution in supermixer
Prototype pollution in Stampit supermixer allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation....
npmsupermixer
Read check MediumCWE-79
Cross-site Scripting in @rocket.chat/livechat
A blind self XSS vulnerability exists in RocketChat LiveChat versions lower than 1.9 that could allow an attacker to trick a victim pasting malicious code...
npm@rocket.chat/livechat
Read check MediumCWE-601
URL Confusion When Scheme Not Supplied in medialize/uri.js
Medialize is a Javascript URL mutation library. When parsing a URL without a scheme and with excessive slashes, like ///www.example.com, URI.js will parse the hostname...
npmurijs
Read check MediumCWE-79
Cross site scripting in valine
valine is a fast, simple & powerful comment system. Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. A...
npmvaline
Read check MediumCWE-79
Cross-site Scripting in tableexport.jquery.plugin
There is a cross-site scripting vulnerability with default onCellHtmlData function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. This can result in transmitting cookies to third-party...
npmtableexport.jquery.plugin
Read check HighCWE-1321
Prototype Pollution in fullpage.js
fullPage utils are available to developers using window.fp_utils. They can use these utils for their own use-case (other than fullPage) as well. However, one of...
npmfullpage.js
Read check MediumCWE-79
Cross-site Scripting in fullpage.js
using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow for...
npmfullpage.js
Read check HighCWE-1321
Prototype Pollution in madlib-object-utils
The package madlib-object-utils before version 0.1.8 is vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into...
npmmadlib-object-utils
Read check HighCWE-434
Unrestricted Upload of File with Dangerous Type in ButterCMS
An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.
npmbuttercms
Read check HighCWE-434
Unrestricted Upload of File with Dangerous Type in Payload
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.
npmpayload
Read check HighCWE-74
Improper handling of multiline messages in node-irc affects matrix-appservice-irc
matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having...
npmmatrix-appservice-irc
Read check MediumCWE-79
Cross-site Scripting in Auth0 Lock
In versions before and including 11.32.2, when the “additional signup fields” feature is configured, a malicious actor can inject invalidated HTML code into these additional...
npmauth0-lock
Read check MediumCWE-843
Prototype Pollution in json-pointer
This affects versions of package json-pointer up to and including 0.6.1. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer...
npmjson-pointer
Read check MediumCWE-79
x-data-spreadsheet through 1.1.9 vulnerable to Cross-site Scripting
All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of values inserted into the cells.
npmx-data-spreadsheet
Read check HighCWE-94
Prototype pollution in dojo - dojo
In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution.
npmdojo
Read check MediumCWE-79
Improper Neutralization of Input During Web Page Generation in CKEditor4
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user...
npmckeditor4
Read check MediumCWE-79
Improper Neutralization of Input During Web Page Generation in swagger-ui
swagger-ui has XSS in key names
npmswagger-ui
Read check HighCWE-94
Improper Control of Generation of Code in doT
The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if...
npmdot
Read check MediumCWE-79
Improper Neutralization of Input During Web Page Generation in Select2
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when...
npmselect2
Read check HighCWE-212
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi - @strapi/strapi
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other...
npm@strapi/strapi
Read check HighCWE-212
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API...
npm@strapi/strapi
Read check HighCWE-20
Improper Input Validation in Deap
The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker...
npmdeap
Read check MediumCWE-79
AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes
Versions of angular prior to 1.5.0-beta.1 are vulnerable to Cross-Site Scripting. The package fails to sanitize xlink:href attributes, which may allow attackers to execute arbitrary...
npmangular
Read check HighCWE-74
cruddl vulnerable to ArangoDB Query Language (AQL) injection through flexSearch
If a vunerable version of cruddl is used to generate a schema that uses @flexSearchFulltext, users of that schema may be able to inject arbitrary...
npmcruddl
Read check High
OpenPGP 1.2.0 and earlier decrypts arbitrary messages
s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is...
npmopenpgp
Read check HighCWE-502
Unsanitized JavaScript code injection possible in gatsby-plugin-mdx
The gatsby-plugin-mdx plugin prior to versions 3.15.2 and 2.14.1 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its...
npmgatsby-plugin-mdx
Read check MediumCWE-200
Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy
The nestjs-proxy library did not have a way to block sensitive cookies (e.g. session cookies) from being forwarded to backend services configured by the application...
npm@finastra/nestjs-proxy
Read check HighCWE-754
Improper handling of CSS at-rules in lettersanitizer
All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes.
npmlettersanitizer
Read check HighCWE-200
Hostname confusion in parse-url
Exposure of Sensitive Information to an Unauthorized Actor via hostname confusion in GitHub repository ionicabizau/parse-url prior to 6.0.1
npmparse-url
Read check HighCWE-918
Server-Side Request Forgery in parse-url
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.
npmparse-url
Read check MediumCWE-200
Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy
The nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application...
npm@finastra/nestjs-proxy
Read check HighCWE-1333
jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method
Summary
npmjquery-validation
Read check MediumCWE-79
Cross site scripting in parse-url
Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 6.0.1
npmparse-url
Read check HighCWE-1321
Prototype Pollution in deep-get-set
All versions of package deep-get-set are vulnerable to Prototype Pollution via the ‘deep’ function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715
npmdeep-get-set
Read check HighCWE-347
JWS and JWT signature validation vulnerability with special characters
Jsrsasign supports JWS(JSON Web Signatures) and JWT(JSON Web Token) validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters...
npmjsrsasign
Read check HighCWE-697
Regular expression denial of service in react-native
A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This...
npmreact-native
Read check MediumCWE-918
Server-Side Request Forgery in link-preview-js
The package link-preview-js before 2.1.17 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read...
npmlink-preview-js
Read check MediumCWE-79
Cross site scripting in parse-url - parse-url
Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.
npmparse-url
Read check HighCWE-639
Authorization Bypass in parse-path
Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.
npmparse-path
Read check HighCWE-1321
set-deep-prop Prototype Pollution
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.
npmset-deep-prop
Read check HighCWE-1321
ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse`
This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they...
npmion-parser
Read check High
node-import `params` argument can be controlled by users without any sanitization
This affects all versions of package node-import. The params argument of module function can be controlled by users without any sanitization. This is then provided...
npmnode-import
Read check HighCWE-1321
ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution
The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the merge function.
npmts-deepmerge
Read check MediumCWE-79
markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped
This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.
npmmarkdown-it-toc
Read check MediumCWE-79
grapesjs before 0.19.5 vulnerable to Cross-site Scripting
The package grapesjs before 0.19.5 is vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.
npmgrapesjs
Read check HighCWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify
utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.
npmutilitify
Read check MediumCWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util
vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could be tricked into adding or modifying properties of the Object.prototype....
npmvega-util
Read check HighCWE-915
Prototype Pollution in cookiex/deep
The npm @cookiex/deep package before version 0.0.7 has a prototype pollution vulnerability. The global proto object can be polluted using the proto object.
npm@cookiex/deep
Read check HighCWE-915
Uncontrolled Resource Consumption in fun-map
fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of ‘Object.prototype’ using a ‘proto’ payload....
npmfun-map
Read check HighCWE-1321
Prototype Pollution in arr-flatten-unflatten
All versions of package arr-flatten-unflatten up to and including version 1.1.4 are vulnerable to Prototype Pollution via the constructor.
npmarr-flatten-unflatten
Read check MediumCWE-915
Prototype pollution in class-transformer
class-transformer through 0.2.3 is vulnerable to Prototype Pollution. The ‘classToPlainFromExist’ function could be tricked into adding or modifying properties of ‘Object.prototype’ using a ‘proto’ payload....
npmclass-transformer
Read check HighCWE-915
Prototype Pollution in madlib-object-utils - madlib-object-utils
madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
npmmadlib-object-utils
Read check HighCWE-915
Prototype Pollution in x-assign
This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the proto object.
npmx-assign
Read check MediumCWE-670
Solana Pay Vulnerable to Weakness in Transfer Validation Logic
When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the...
npm@solana/pay
Read check MediumCWE-79
Cross-Site Scripting in min-http-server
All versions of min-http-server are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim’s...
npmmin-http-server
Read check HighCWE-915
Prototype pollution in chart.js
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing...
npmchart.js
Read check HighCWE-915
Prototype Pollution in property-expr
The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
npmproperty-expr
Read check HighCWE-119
RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign
Jsrsasign can verify RSA-PSS signature which value can expressed as BigInteger. When there is a valid RSA-PSS signature value, this vulnerability is also accept value...
npmjsrsasign
Read check MediumCWE-79
Cross site scripting in mobiledoc-kit
Cross-site Scripting (XSS) - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2.
npmmobiledoc-kit
Read check HighCWE-400
Uncontrolled Resource Consumption in node-opcua
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per...
npmnode-opcua
Read check MediumCWE-115
parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing
parse-url prior to 8.1.0 is vulnerable to Misinterpretation of Input. parse-url parses certain http or https URLs incorrectly, identifying the URL’s protocol as ssh. It...
npmparse-url
Read check MediumCWE-89
Matrix-appservice-irc vulnerable to sql injection via roomIds argument
A vulnerability was found in matrix-appservice-irc up to 0.35.1. This vulnerability affects the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection....
npmmatrix-appservice-irc
Read check MediumCWE-1321
deep-object-diff vulnerable to Prototype Pollution
deep-object-diff before version 1.1.6 allows an external attacker to edit or add new properties to an object. This is possible because the application does not...
npmdeep-object-diff
Read check MediumCWE-79
Cross-site scripting vulnerability in TinyMCE alerts
A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur...
npmtinymce
Read check HighCWE-89
@cubejs-backend/api-gateway row level security bypass
All authenticated Cube clients could bypass row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint.
npm@cubejs-backend/api-gateway
Read check HighCWE-94
dustjs-linkedin vulnerable to Prototype Pollution
A vulnerability was found in LinkedIn dustjs prior to version 3.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation...
npmdustjs-linkedin
Read check MediumCWE-79
Jodit Editor vulnerable to Cross-site Scripting - jodit
Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting...
npmjodit
Read check HighCWE-347
secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery
The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.
npm@lionello/secp256k1-js
Read check MediumCWE-269
matrix-appservice-irc vulnerable to IRC mode parameter confusion
IRC allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc...
npmmatrix-appservice-irc
Read check HighCWE-269
Parsing issue in matrix-org/node-irc leading to room takeovers
Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to...
npmmatrix-appservice-irc
Read check HighCWE-79
@mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS)
The sanitize-svg package uses a deny-list-pattern to sanitize SVGs to prevent cross-site scripting (XSS). In doing so, literal <script>-tags and on-event handlers were detected:
npm@mattkrick/sanitize-svg
Read check MediumCWE-79
Cross-site Scripting in Joplin
An XSS issue in Joplin desktop allows arbitrary code execution via a malicious HTML embed tag.
npmjoplin
Read check HighCWE-1333
inflect vulnerable to Inefficient Regular Expression Complexity
inflect is customizable inflections for nodejs. inflect is vulnerable to Inefficient Regular Expression Complexity
npmi
Read check HighCWE-915
merge vulnerable to Prototype Pollution
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’)
npm@viking04/merge
Read check HighCWE-835
cumulative-distribution-function Infinite Loop vulnerability
A flaw enabling an infinite-loop was discovered in the code for evaluating the cumulative-distribution-functionof input data. Although the documentation explains that numeric data is required,...
npmcumulative-distribution-function
Read check MediumCWE-400
prismjs Regular Expression Denial of Service vulnerability
Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide...
npmprismjs
Read check MediumCWE-20
Improper Input Validation in Google Closure Library
A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to...
npmgoogle-closure-library
Read check MediumCWE-1321
deep-parse-json vulnerable to Prototype Pollution
deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly...
npmdeep-parse-json
Read check LowCWE-94
Improper Control of Generation of Code ('Code Injection') in mdx-mermaid
Arbitary javascript injection
npmmdx-mermaid
Read check MediumCWE-79
DOM-based cross-site scripting in Froala Editor
Froala WYSIWYG HTML Editor is a lightweight WYSIWYG HTML Editor written in JavaScript that enables rich text editing capabilities for web applications. A DOM-based cross-site...
npmfroala-editor
Read check HighCWE-79
Options structure open to Cross-site Scripting if passed unfiltered
In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted...
npmhighcharts
Read check MediumCWE-915
Prototype poisoning
The issue is as follows: when msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to __proto__. As you are no...
npmmsgpack5
Read check HighCWE-942
Remote code execution in Eclipse Theia
In Eclipse Theia 0.3.9 to 1.8.1, the “mini-browser” extension allows a user to preview HTML files in an iframe inside the IDE. But with the...
npm@theia/mini-browser
Read check HighCWE-79
Joplin is vulnerable to arbitrary code execution
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
npmjoplin
Read check MediumCWE-79
Smoothie vulnerable to Cross-site Scripting when tooltipLabel or strokeStyle are controlled by users
The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties....
npmsmoothie
Read check HighCWE-770
node-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limit
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA...
npmnode-opcua
Read check HighCWE-400
node-opcua DoS when bypassing limitations for excessive memory consumption
The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests...
npmnode-opcua
Read check HighCWE-322
matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification
An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of...
npmmatrix-js-sdk
Read check HighCWE-1321
steal vulnerable to Prototype Pollution via optionName variable
Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.
npmsteal
Read check HighCWE-697
Inefficient Regular Expression Complexity in vuelidate
vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS (regular expression denial of service) flaw was found in the @vuelidate/validators...
npm@vuelidate/validators
Read check HighCWE-471
TypeORM vulnerable to MAID and Prototype Pollution
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or...
npmtypeorm
Read check MediumCWE-20
Improper beacon events in matrix-js-sdk can result in availability issues
Improperly formed beacon events (from MSC3488) can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer’s ability to process data safely. Note...
npmmatrix-js-sdk
Read check HighCWE-1321
steal vulnerable to Prototype Pollution via key variable in babel.js
Prototype pollution vulnerability in function extend in babel.js in stealjs steal via the key variable in babel.js.
npmsteal
Read check HighCWE-1321
steal vulnerable to Prototype Pollution via requestedVersion variable
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal via the requestedVersion variable in the npm-convert.js file.
npmsteal
Read check HighCWE-287
matrix-js-sdk subject to impersonated messages due to permissive key forwarding
An attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey...
npmmatrix-js-sdk
Read check MediumCWE-400
CKEditor 5 Markdown plugin Regular expression Denial of Service
A regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link...
npm@ckeditor/ckeditor5-markdown-gfm
Read check HighCWE-322
matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion
An attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a...
npmmatrix-js-sdk
Read check HighCWE-74
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and...
npmejs
Read check MediumCWE-79
@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details
Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track frontend renders them using the JavaScript library Showdown. Showdown does not...
npm@dependencytrack/frontend
Read check MediumCWE-400
jsx-slack insufficient patch for CVE-2021-43838 ReDoS
We found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient to save from Regular Expression Denial of Service (ReDoS) attack.
npmjsx-slack
Read check LowCWE-80
jquery.terminal self XSS on user input
This is low impact and limited XSS, because code for XSS payload is always visible, but attacker can use other techniques to hide the code...
npmjquery.terminal
Read check MediumCWE-79
Vuetify Cross-site Scripting vulnerability
The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the ‘eventName’ function within the...
npmvuetify
Read check HighCWE-1321
Prototype Pollution in mout
This affects all versions of package mout. The deepFillIn function can be used to ‘fill missing properties recursively’, while the deepMixIn mixes objects into the...
npmmout
Read check HighCWE-335
Fastly Compute@Edge JS Runtime has fixed random number seed during compilation
Math.random and crypto.getRandomValues methods failed to use sufficiently random values. The initial value to seed the CSPRNG (cryptographically secure pseudorandom number generator) was baked-in to...
npm@fastly/js-compute
Read check HighCWE-95
React Editable Json Tree vulnerable to arbitrary code execution via function parsing
Our library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript’s eval function was used to...
npmreact-editable-json-tree
Read check MediumCWE-79
Cross-site Scripting (XSS) in serve-lite
All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file...
npmserve-lite
Read check HighCWE-22
Directory Traversal vulnerability in serve-lite
All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url...
npmserve-lite
Read check HighCWE-668
TaffyDB can allow access to any data items in the DB - taffy
TaffyDB allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. Taffy...
npmtaffy
Read check HighCWE-668
TaffyDB can allow access to any data items in the DB
TaffyDB allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. Taffy...
npmtaffydb
Read check HighCWE-119
RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign
Jsrsasign supports RSA PKCS#1 v1.5 (i.e. RSAES-PKCS1-v1_5) and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted...
npmjsrsasign
Read check HighCWE-347
ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign
Jsrsasign supports ECDSA signature validation which signature value is represented by ASN.1 DER encoding. This vulnerablity may accept a wrong ASN.1 DER encoded ECDSA signature...
npmjsrsasign
Read check HighCWE-1321
Prototype Pollution in dojo
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
npmdojo
Read check HighCWE-22
Path Traversal in mcstatic
All versions of mcstatic are vulnerable to path traversal.
npmmcstatic
Read check MediumCWE-79
metascraper before v5.2.0 vulnerable to stored cross-site scripting
Versions of metascraper prior to 5.2.0 are vulnerable to stored cross-site scripting (XSS).
npmmetascraper
Read check MediumCWE-79
CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-html-support
@ckeditor/ckeditor5-markdown-gfm@ckeditor/ckeditor5-html-support@ckeditor/ckeditor5-html-embed
npm@ckeditor/ckeditor5-html-support
Read check MediumCWE-79
CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-markdown-gfm
@ckeditor/ckeditor5-markdown-gfm@ckeditor/ckeditor5-html-support@ckeditor/ckeditor5-html-embed
npm@ckeditor/ckeditor5-markdown-gfm
Read check MediumCWE-79
CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process
@ckeditor/ckeditor5-markdown-gfm@ckeditor/ckeditor5-html-support@ckeditor/ckeditor5-html-embed
npm@ckeditor/ckeditor5-html-embed
Read check MediumCWE-1321
@ianwalter/merge Prototype Pollution via `merge` function
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. @ianwalter/merge is deprecated and the maintainer suggests using @generates/merger instead....
npm@ianwalter/merge
Read check HighCWE-78
Nadesiko3 OS Command Injection vulnerability
OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.68 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and...
npmnadesiko3
Read check MediumCWE-755
nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit
Nako3edit is the editor component of Nadeshiko 3, a programming language developed based on Japanese. Improper check or handling of exceptional conditions in Nako3edit v3.3.74...
npmnadesiko3
Read check HighCWE-78
nadesiko3 vulnerable to OS Command Injection
OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product...
npmnadesiko3
Read check HighCWE-1321
steal vulnerable to Prototype Pollution
Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js.
npmsteal
Read check HighCWE-79
Valine code injection vulnerability
Valine was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.
npmvaline
Read check MediumCWE-79
Toast UI Grid vulnerable to Cross-site Scripting
Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted...
npmtui-grid
Read check HighCWE-1321
steal vulnerable to Prototype Pollution via alias variable
Prototype pollution vulnerability in stealjs steal via the alias variable in babel.js.
npmsteal
Read check HighCWE-400
Regular Expression Denial of Service in ua-parser-js
The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA....
npmua-parser-js
Read check MediumCWE-1321
Prototype Pollution in dset
All versions of dset prior to 3.1.2 are vulnerable to Prototype Pollution via dset/merge mode, as the dset function checks for prototype pollution by validating...
npmdset
Read check MediumCWE-79
materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input
All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a-tag />) that is being...
npmmaterialize-css
Read check High
Privilege Issues in jailed
All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored...
npmjailed
Read check HighCWE-1321
Prototype Pollution in Dexie
Dexie is a minimalistic wrapper for IndexedDB. The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj,...
npmdexie
Read check HighCWE-922
Insecure password handling vulnerability in Strapi
Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a...
npm@strapi/strapi
Read check MediumCWE-79
Cross-site Scripting in video.js
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
npmvideo.js
Read check MediumCWE-79
Cross-site Scripting in jquery.json-viewer
The jquery.json-viewer library before version 1.5.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT...
npmjquery.json-viewer
Read check MediumCWE-79
Cross-site Scripting in pandao editor.md
pandao Editor.md 1.5.0 allows XSS via the Javascript: string.
npmeditor.md
Read check MediumCWE-327
Invalid Curve Attack in openpgp
Versions of openpgp prior to 4.3.0 are vulnerable to an Invalid Curve Attack. The package’s implementation of ECDH fails to verify the validity of the...
npmopenpgp
Read check MediumCWE-79
Cross-site Scripting in node-red-dashboard
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
npmnode-red-dashboard
Read check HighCWE-94
Sandbox Breakout / Arbitrary Code Execution in safer-eval - safer-eval - GHSA-hgch-jjmr-gp7w
Versions of safer-eval before 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and...
npmsafer-eval
Read check MediumCWE-79
Cross-site Scripting in pandao
pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.
npmeditor.md
Read check HighCWE-94
Sandbox Breakout / Arbitrary Code Execution in safer-eval - safer-eval - GHSA-r3x4-wr4h-pw33
Versions of safer-eval prior to 1.3.4 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox...
npmsafer-eval
Read check MediumCWE-79
XSS in knockout
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its...
npmknockout
Read check MediumCWE-248
Uncaught exception in engine.io
A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.
npmengine.io
Read check HighCWE-74
Denial of Service and Content Injection in i18n-node-angular
Versions of i18n-node-angular prior to 1.4.0 are affected by denial of service and cross-site scripting vulnerabilities. The vulnerabilities exist in a REST endpoint that was...
npmi18n-node-angular
Read check HighCWE-94
Sandbox Breakout / Arbitrary Code Execution in safer-eval - safer-eval
All versions of safer-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and...
npmsafer-eval
Read check MediumCWE-79
node-red-dashboard vulnerable to Cross-site Scripting
node-red-dashboard contains a cross-site scripting vulnerability. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The attack may...
npmnode-red-dashboard
Read check MediumCWE-79
Cross-Site Scripting in @novnc/novnc
Versions of @novnc/novnc prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as...
npm@novnc/novnc
Read check MediumCWE-79
Cross-site Scripting in Joplin - joplin - GHSA-6r7x-hc8m-985r
Joplin through 1.0.184 allows Arbitrary File Read via Cross-site Scripting (XSS).
npmjoplin
Read check LowCWE-345
Unprotected dynamically loaded chunks
All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes...
npmwebpack-subresource-integrity
Read check MediumCWE-471
Prototype Pollution in highlight.js
Affected versions of this package are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of...
npmhighlight.js
Read check MediumCWE-918
Axios vulnerable to Server-Side Request Forgery
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that...
npmaxios
Read check HighCWE-400
regular expression denial of service (ReDoS) - date-and-time
date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be...
npmdate-and-time
Read check MediumCWE-400
Regular Expression Denial of Service (REDoS) in Marked
Regular expression Denial of Service
npmmarked
Read check MediumCWE-918
SSRF in Rendertron
Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force...
npmrendertron
Read check HighCWE-400
Prototype pollution in JointJS - jointjs
The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object’s key and set the value...
npmjointjs
Read check HighCWE-94
Angular Expressions - Remote Code Execution
The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input.
npmangular-expressions
Read check HighCWE-1321
Prototype pollution in set-in - set-in
Prototype pollution vulnerability in ‘set-in’ versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
npmset-in
Read check MediumCWE-79
Cross-site Scripting in vis-timeline
This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code...
npmvis-timeline
Read check MediumCWE-400
Regular expression Denial of Service in @progfay/scrapbox-parser
A Regular expression Denial of Service flaw was found in the @progfay/scrapbox-parser package before 6.0.3, 7.0.2 for Node.js.The attacker that is able to be parsed...
npm@progfay/scrapbox-parser
Read check HighCWE-79
Cross-site Scripting (XSS) in Eclipse Theia
In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.
npm@theia/preview
Read check MediumCWE-78
[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values
Potential for arbitrary code execution in #gpg-tagged property values (only if decrypt: true option is enabled)
npm@thi.ng/egf
Read check HighCWE-1321
Prototype Pollution Vulnerability in object-collider
Prototype pollution vulnerability in ‘object-collider’ versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.
npmobject-collider
Read check HighCWE-400
Denial of Service (DoS) via the unsetByPath function in jsjoints
The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.
npmjointjs
Read check MediumCWE-20
Hostname spoofing via backslashes in URL
If using affected versions to determine a URL’s hostname, the hostname can be spoofed by using a backslash (\) character followed by an at (@)...
npmurijs
Read check MediumCWE-79
Improper Neutralization of Input in Theia console
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected....
npm@theia/console
Read check LowCWE-79
XSS in Vega
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package.In Vega before version 5.17.3...
npmvega
Read check MediumCWE-79
Cross-site scripting in SocksJS-node
htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
npmsockjs
Read check HighCWE-22
Path traversal in Node-RED-Dashboard
In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows ui_base/js/..%2f directory traversal to read files.
npmnode-red-dashboard
Read check MediumCWE-74
Prototype Pollution in dot-object
dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a proto payload....
npmdot-object
Read check MediumCWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-engine
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...
npm@ckeditor/ckeditor5-engine
Read check MediumCWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-font
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...
npm@ckeditor/ckeditor5-font
Read check MediumCWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-image
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...
npm@ckeditor/ckeditor5-image
Read check MediumCWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-list
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...
npm@ckeditor/ckeditor5-list
Read check MediumCWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-media-embed
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...
npm@ckeditor/ckeditor5-media-embed
Read check MediumCWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-paste-from-office
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...
npm@ckeditor/ckeditor5-paste-from-office
Read check MediumCWE-400
Regular expression Denial of Service in multiple packages - @ckeditor/ckeditor5-widget
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...
npm@ckeditor/ckeditor5-widget
Read check MediumCWE-400
Regular expression Denial of Service in multiple packages
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which...
npm@ckeditor/ckeditor5-markdown-gfm
Read check HighCWE-918
Server-Side Request Forgery in private-ip
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF.
npmprivate-ip
Read check HighCWE-400
Prototype Pollution in decal - decal
This affects all versions of package decal. The vulnerability is in the set function.
npmdecal
Read check HighCWE-400
Regular Expression Denial of Service (ReDoS) in ua-parser-js
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header,...
npmua-parser-js
Read check HighCWE-94
Arbitrary code execution in djv
This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.
npmdjv
Read check HighCWE-1321
Prototype pollution in set-object-value
Prototype pollution vulnerability in ‘set-object-value’ versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution....
npmset-object-value
Read check HighCWE-1321
Prototype Pollution in copy-props
The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.
npmcopy-props
Read check MediumCWE-400
Regular Expression Denial of Service in hosted-git-info
The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js....
npmhosted-git-info
Read check HighCWE-20
Improper Input Validation in klona
Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or...
npmklona
Read check MediumCWE-20
Improper Input Validation in sanitize-html - sanitize-html
Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the “allowedIframeHostnames” option when the “allowIframeRelativeUrls” is set to true, which allows...
npmsanitize-html
Read check HighCWE-345
Insufficient Verification of Data Authenticity in Eclipse Theia
In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is “Mini-Browser”, published as “@theia/mini-browser” on npmjs.com.
npm@theia/mini-browser
Read check MediumCWE-20
Improper Input Validation in SocksJS-Node
Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
npmsockjs
Read check MediumCWE-74
Prototype Pollution in undefsafe
undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The ‘a’ function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload....
npmundefsafe
Read check HighCWE-400
Resource exhaustion in socket.io-parser
The socket.io-parser npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a...
npmsocket.io-parser
Read check MediumCWE-696
Padding Oracle Attack due to Observable Timing Discrepancy in jose
jose is an npm library providing a number of cryptographic operations.
npmjose
Read check HighCWE-471
Prototype pollution in json8-merge-patch
Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
npmjson8-merge-patch
Read check MediumCWE-79
Cross-site Scripting in reveal.js - reveal.js
Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks.
npmreveal.js
Read check HighCWE-287
Improper Authentication in react-adal
This affects versions of react-adal < 0.5.1. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and...
npmreact-adal
Read check HighCWE-20
Prototype pollution in pathval
A prototype pollution vulnerability affects all versions of package pathval under 1.1.1.
npmpathval
Read check HighCWE-1321
Prototype Pollution in set-or-get
Prototype pollution vulnerability in ‘set-or-get’ version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution....
npmset-or-get
Read check MediumCWE-400
Regular expression denial of service in codemirror
This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129.
npmcodemirror
Read check HighCWE-400
Regular Expression Denial of Service in dat.gui
All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.
npmdat.gui
Read check HighCWE-400
Regular Expression Denial of Service in trim
All versions of package trim lower than 0.0.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
npmtrim
Read check MediumCWE-79
Cross-site scripting in @atlaskit/editor-core
The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in...
npm@atlaskit/editor-core
Read check HighCWE-120
Buffer overflow in canvas
A buffer overflow is present in canvas versions before 1.6.11, which could lead to a Denial of Service or execution of arbitrary code when it...
npmcanvas
Read check HighCWE-1321
Prototype pollution in json8
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly...
npmjson8
Read check HighCWE-1321
Prototype Pollution in node-oojs
All versions of package node-oojs up to and including version 1.4.0 are vulnerable to Prototype Pollution via the setPath function.
npmnode-oojs
Read check HighCWE-1321
Prototype Pollution in phpjs
All versions of phpjs up to and including 1.3.2 are vulnerable to Prototype Pollution via parse_str. phpjs is no longer maintained and users are advised...
npmphpjs
Read check HighCWE-1321
Prototype Pollution in promisehelpers
All versions of package promisehelpers up to and including version 0.0.5 are vulnerable to Prototype Pollution via the insert function.
npmpromisehelpers
Read check MediumCWE-400
Regular expression denial of service in @absolunet/kafe
This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.
npm@absolunet/kafe
Read check HighCWE-22
Path traversal in rollup-plugin-serve
Path traversal in npm package rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation.
npmrollup-plugin-serve
Read check HighCWE-1321
Prototype Pollution in tiny-conf
All versions of package tiny-conf up to and including version 1.1.0 are vulnerable to Prototype Pollution via the set function.
npmtiny-conf
Read check HighCWE-94
Improper Input Validation in access-policy
access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the template function is executed by the eval function resulting in code...
npmaccess-policy
Read check HighCWE-20
Improper parsing of octal bytes in netmask
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks...
npmnetmask
Read check HighCWE-1321
Prototype Pollution in gedi
All versions of package gedi up to and including version 1.6.3 are vulnerable to Prototype Pollution via the set function.
npmgedi
Read check HighCWE-79
Insecure template handling in haml-coffee
haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding...
npmhaml-coffee
Read check MediumCWE-400
Regular Expression Denial of Service in postcss - postcss
The npm package postcss from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing....
npmpostcss
Read check MediumCWE-79
Cross-site scripting in Joplin - joplin
Joplin allows XSS via a LINK element in a note.
npmjoplin
Read check MediumCWE-79
Cross-site Scripting in aurelia-framework
The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter...
npmaurelia-framework
Read check HighCWE-20
Validation bypass in jpv
jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.
npmjpv
Read check MediumCWE-829
Command Injection in @theia/messages
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
npm@theia/messages
Read check MediumCWE-668
Exposure of Resource to Wrong Sphere in valib
valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function...
npmvalib
Read check HighCWE-1321
Prototype Pollution in swiper
Versions of the package swiper before 6.5.1 are susceptible to prototype pollution.
npmswiper
Read check HighCWE-400
ua-parser-js Regular Expression Denial of Service vulnerability
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
npmua-parser-js
Read check HighCWE-78
Injection and Command Injection in devcert
A command injection vulnerability in the devcert module may lead to remote code execution when users of the module pass untrusted input to the certificateFor...
npmdevcert
Read check MediumCWE-400
Uncontrolled Resource Consumption in firebase
This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided,...
npm@firebase/util
Read check HighCWE-94
Code Injection in cd-messenger
cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the color argument executed by the eval function resulting in code execution....
npmcd-messenger
Read check HighCWE-1321
Prototype pollution in controlled-merge
Prototype pollution vulnerability in ‘controlled-merge’ versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
npmcontrolled-merge
Read check HighCWE-1321
Prototype Pollution in deep-get-set - deep-get-set
All versions of package deep-get-set prior to version 1.1.1 are vulnerable to Prototype Pollution via the main function.
npmdeep-get-set
Read check HighCWE-1321
Prototype Pollution in safe-object2
All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.
npmsafe-object2
Read check MediumCWE-79
Cross-site Scripting in docsify
docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files....
npmdocsify
Read check HighCWE-94
Code Injection in mosc
mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to properties argument is executed by the eval function, resulting in code execution....
npmmosc
Read check HighCWE-1321
Prototype Pollution in deep-override
Prototype pollution vulnerability in ‘deep-override’ versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution....
npmdeep-override
Read check MediumCWE-79
Cross-site scripting in react-bootstrap-table
All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is...
npmreact-bootstrap-table
Read check HighCWE-400
Regular Expression Denial of Service (ReDoS) in Prism
Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).
npmprismjs
Read check HighCWE-79
Widget feature vulnerability allowing to execute JavaScript code using undo functionality
The vulnerability has been discovered in Widget plugin if used alongside Undo feature.
npmckeditor4
Read check HighCWE-1321
Prototype pollution in safe-obj
Prototype pollution vulnerability in ‘safe-obj’ versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution....
npmsafe-obj
Read check MediumCWE-94
Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality
The vulnerability has been discovered in clipboard plugin. All plugins with clipboard plugin dependency are affected:
npmckeditor4
Read check MediumCWE-94
Denial of service in Valine
Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a...
npmvaline
Read check HighCWE-79
Reflected XSS when using flashMessages or languageDictionary
Versions before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library’s flashMessage feature is utilized and user...
npmauth0-lock
Read check MediumCWE-843
Passing in a non-string 'html' argument can lead to unsanitized output
A type-confusion vulnerability can cause striptags to concatenate unsanitized strings when an array-like object is passed in as the html parameter. This can be abused...
npmstriptags
Read check HighCWE-770
ReDOS in IS-SVG
A vulnerability was discovered in IS-SVG version 4.3.1 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and...
npmis-svg
Read check MediumCWE-770
Regular Expression Denial of Service (ReDOS) - color-string
In the npm package color-string, there is a ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity forlinearly increasing input lengths for...
npmcolor-string
Read check MediumCWE-79
Cross-site Scripting in curly-bracket-parser
This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.
npmcurly-bracket-parser
Read check HighCWE-79
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
The vulnerability has been discovered in Fake Objects plugin. All plugins with Fake Objects plugin dependency are affected:
npmckeditor4
Read check MediumCWE-915
Prototype Pollution in deepmergefn
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
npmdeepmergefn
Read check MediumCWE-79
Clipboard-based DOM-XSS
A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library.
npm@github/paste-markdown
Read check MediumCWE-1321
Prototype Pollution in mootools
This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()
npmmootools
Read check HighCWE-682
Incorrect Calculation in the MSR JavaScript Cryptography Library
A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography (ECC)...
npmmsrcrypto
Read check MediumCWE-79
Cross-site Scripting in file-upload-with-preview
This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked...
npmfile-upload-with-preview
Read check MediumCWE-843
Prototype Pollution in jointjs
This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the...
npmjointjs
Read check MediumCWE-755
Uncontrolled Resource Consumption in transpile
All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception...
npmtranspile
Read check MediumCWE-22
Path traversal
A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for docs_dir in...
npm@backstage/techdocs-common
Read check HighCWE-1321
Prototype pollution vulnerability in 'patchmerge
Prototype pollution vulnerability in ‘patchmerge’ versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution....
npmpatchmerge
Read check MediumCWE-77
Script injection - @backstage/plugin-techdocs
A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This may give access to...
npm@backstage/plugin-techdocs
Read check MediumCWE-77
Script injection
A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by...
npm@backstage/techdocs-common
Read check MediumCWE-79
Cross-site Scripting in jsoneditor
Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
npmjsoneditor
Read check MediumCWE-829
Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor,...
npmckeditor4
Read check HighCWE-522
Basic-auth app bundle credential exposure in gatsby-source-wordpress
The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not...
npmgatsby-source-wordpress
Read check MediumCWE-79
Cross-site Scripting in Mermaid
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
npmmermaid
Read check MediumCWE-79
Cross-site Scripting in tempura
This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without...
npmtempura
Read check HighCWE-400
Improper Input Validation in is-email
is-email helps validate an email address. A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js....
npmis-email
Read check HighCWE-915
Prototype pollution in aurelia-path
The vulnerability exposes Aurelia application that uses aurelia-path package to parse a string. The majority of this will be Aurelia applications that employ the aurelia-router...
npmaurelia-path
Read check MediumCWE-79
XSS vulnerability allowing arbitrary JavaScript execution
Today we are releasing Grafana 8.2.3. This patch release includes an important security fix for an issue that affects all Grafana versions from 8.0.0-beta1.
npm@grafana/data
Read check MediumCWE-79
Cross-site scripting in anchorme
All versions of package anchorme are vulnerable to Cross-site Scripting (XSS) via the main functionality.
npmanchorme
Read check MediumCWE-79
Cross-site Scripting in Froala Editor - froala-editor
Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within...
npmfroala-editor
Read check HighCWE-352
Cross Site Request Forgery in kindeditor
Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x. First, you upload an html file containing csrf on the website that uses a google...
npmkindeditor
Read check HighCWE-79
GraphiQL introspection schema template injection attack
This is a security advisory for an XSS vulnerability in graphiql.
npmgraphiql
Read check MediumCWE-200
Unauthorized access to data in @sap-cloud-sdk/core
This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations.In some cases, when user information was...
npm@sap-cloud-sdk/core
Read check MediumCWE-400
Uncontrolled Resource Consumption in trim-off-newlines
All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.
npmtrim-off-newlines
Read check HighCWE-915
Prototype Pollution in merge-change
All current versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.
npmmerge-change
Read check HighCWE-79
Unsafe defaults in `remark-html`
The documentation of remark-html has mentioned that it was safe by default. In practise the default was never safe and had to be opted into....
npmremark-html
Read check High
Prototype pollution vulnerability in 'deepref
Prototype pollution vulnerability in ‘deepref’ versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.
npmdeepref
Read check MediumCWE-352
Cross-site Request Forgery (CSRF) in joplin
The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.
npmjoplin
Read check MediumCWE-79
Cross site scripting in kindeditor
Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this...
npmkindeditor
Read check HighCWE-1321
Prototype Pollution in Proto
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge...
npmProto
Read check HighCWE-79
Clipboard-based XSS
XSS against the user.
npmjsuites
Read check MediumCWE-940
Improper Verification of Communication Channel in @theia/plugin-ext
In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
npm@theia/plugin-ext
Read check MediumCWE-75
Code injection in plupload
This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a...
npmplupload
Read check High
Prototype pollution vulnerability in 'libnested
Prototype pollution vulnerability in ‘libnested’ versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution....
npmlibnested
Read check HighCWE-74
Risk of code injection
Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side security issues
npmrsshub
Read check HighCWE-335
Insecure random number generation in keypair
A bug in the pseudo-random number generator used by keypair versions up to and including 1.0.3 could allow for weak RSA key generation. This could...
npmkeypair
Read check HighCWE-79
Cross-Site Scripting Vulnerability in @joeattardi/emoji-button
There are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2:
npm@joeattardi/emoji-button
Read check MediumCWE-843
Prototype Pollution in dotty - dotty
This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the...
npmdotty
Read check MediumCWE-79
Cross-site Scripting in pekeupload
This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code...
npmpekeupload
Read check HighCWE-1321
Prototype Pollution in @fabiocaccamo/utils.js
utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’).
npm@fabiocaccamo/utils.js
Read check HighCWE-89
Strapi mishandles hidden attributes within admin API responses
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
npm@strapi/strapi
Read check MediumCWE-1022
Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access
A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of the component...
npmtwitter-fetcher-js
Read check MediumCWE-436
Misinterpretation of malicious XML input - xmldom - GHSA-h6q6-9hqw-rwfv
xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.
npmxmldom
Read check MediumCWE-200
liquidjs may leak properties of a prototype
The package liquidjs before 10.0.0 is vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties of a prototype....
npmliquidjs
Read check Medium
Expo on iOS is insecure due incorrect security attribute application
secure-store in Expo through 9.1.0 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.
npmexpo
Read check MediumCWE-79
Markdown-Nice v1.8.22 vulnerable to Cross-site Scripting
A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community...
npmmarkdown-nice
Read check MediumCWE-79
Cross-site Scripting in Bootstrap-3-Typeahead
Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute...
npmbootstrap-3-typeahead
Read check MediumCWE-79
Cross-site Scripting in bootstrap-table
Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure...
npmbootstrap-table
Read check HighCWE-1333
markdown-it vulnerable to Inefficient Regular Expression Complexity
A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The...
npmmarkdown-it
Read check HighCWE-1333
string-kit Inefficient Regular Expression Complexity vulnerability
A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation...
npmstring-kit
Read check MediumCWE-79
Json2html vulnerable to cross-site scripting
Json2html is a client side javascript HTML templating library with wrappers for both jQuery and Node.js. A vulnerability was found in moappi Json2html up to...
npmnode-json2html
Read check MediumCWE-79
Cross site scripting in Metro UI
Metro UI v4.4.0 to v4.5.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function. User input is not properly sanitized...
npmmetro4
Read check MediumCWE-400
Regular Expression Denial of Service in moment - moment
Versions of moment prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is...
npmmoment
Read check HighCWE-1321
Prototype Pollution in js-data - js-data
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442.
npmjs-data
Read check HighCWE-918
uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) - uppy
uppy’s companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.
npmuppy
Read check HighCWE-79
Reflected cross-site scripting (XSS) vulnerability
This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package.
npm@keystone-next/auth
Read check HighCWE-79
Incorrect sanitisation function leads to `XSS` in mermaid
Malicious diagrams can contain javascript code that can be run at diagram readers machines.
npmmermaid
Read check HighCWE-1321
Prototype Pollution in realms-shim - realms-shim
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
npmrealms-shim
Read check HighCWE-1321
Prototype Pollution in realms-shim
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
npmrealms-shim
Read check HighCWE-79
Cross site scripting in three.js
Versions of three.js prior to 0.137.0 load untrusted iframes and allow for attackers to inject arbitrary javascript into a users browser.
npmthree
Read check HighCWE-200
Exposure of Sensitive Information in simple-get
In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially...
npmsimple-get
Read check MediumCWE-1321
Prototype Pollution in keyget
The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a...
npmkeyget
Read check MediumCWE-79
Cross-site Scripting in karma
karma prior to version 6.3.14 contains a cross-site scripting vulnerability.
npmkarma
Read check MediumCWE-918
Server-Side Request Forgery in @peertube/embed-api
@peertube/embed-api version 4.0.0 and prior is vulnerable to server-side request forgery.
npm@peertube/embed-api
Read check HighCWE-79
Cross site scripting in @awsui/components-react
Components could potentially allow cross-site scripting (XSS) in certain circumstances. These components could render content without adequate neutralization.
npm@awsui/components-react
Read check MediumCWE-601
Open redirect in karma
Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.
npmkarma
Read check MediumCWE-639
Authorization Bypass Through User-Controlled Key in urijs
Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647.
npmurijs
Read check HighCWE-1321
Prototype Pollution in litespeed.js and appwrite/server-ce
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl...
npmlitespeed.js
Read check MediumCWE-20
Leading white space bypasses protocol validation
Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail.
npmurijs
Read check HighCWE-1321
Prototype Pollution in object-extend
The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend.
npmobject-extend
Read check HighCWE-79
Cross-site Scripting in Prism
Prism’s Command line plugin can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading...
npmprismjs
Read check MediumCWE-79
Cross site scripting in reveal.js
The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage.
npmreveal.js
Read check MediumCWE-601
Open Redirect in urijs
urijs prior to version 1.19.10 is vulnerable to open redirect. This is the result of a bypass for the fix to CVE-2022-0613.
npmurijs
Read check HighCWE-94
Eta vulnerable to Code Injection via templates rendered with user-defined data
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from...
npmeta
Read check MediumCWE-79
Joplin Desktop App vulnerable to Cross-site Scripting
Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.
npmjoplin
Read check HighCWE-79
XSS Attack with Express API
XSS attack - anyone using the Express API is impacted
npmeta
Read check MediumCWE-79
Cross site scripting in froala-editor
A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor allows attackers to execute arbitrary web scripts or HTML.
npmfroala-editor
Read check MediumCWE-79
Cross site scripting Vulnerability in backstage Software Catalog - @backstage/core-components
This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs...
npm@backstage/core-components
Read check MediumCWE-79
Cross site scripting Vulnerability in backstage Software Catalog
This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs...
npm@backstage/catalog-model
Read check MediumCWE-79
jSuites subect to Cross-site Scripting
Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Editor() function.
npmjsuites
Read check HighCWE-835
Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)
When using the non-default “fallback” crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an...
npmnode-jose
Read check MediumCWE-79
iziModal Cross-site Scripting vulnerability
iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles.
npmizimodal
Read check MediumCWE-79
Baremetrics date range picker vulnerable to Cross-site Scripting
The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior...
npmbaremetrics-calendar
Read check MediumCWE-79
textAngular Cross-site Scripting vulnerability
textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the...
npmtextangular
Read check MediumCWE-79
Mind-elixir Cross-site Scripting vulnerability
Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusted menus. This issue...
npmmind-elixir
Read check MediumCWE-79
Cross-Site-Scripting attack on `<RichTextField>` - react-admin
All React applications built with react-admin and using the <RichTextField> are affected.
npmreact-admin
Read check MediumCWE-79
Cross-Site-Scripting attack on `<RichTextField>`
All React applications built with react-admin and using the <RichTextField> are affected.
npmra-ui-materialui
Read check MediumCWE-79
Cross-site scripting in CKEditor5
CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget.
npmckeditor5
Read check LowCWE-79
Cross-site Scripting in dijit editor's LinkDialog plugin
XSS possible for users of the Dijit Editor’s LinkDialog plugin
npmdijit
Read check HighCWE-22
Path Traversal in localhost-now - localhost-now - GHSA-2gjg-5x33-mmp2
Versions of localhost-now before 1.0.2 are vulnerable to path traversal. This allows a remote attacker to read the content of an arbitrary file.
npmlocalhost-now
Read check MediumCWE-79
Cross-site Scripting in jspreadsheet
The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS).
npmjspreadsheet-ce
Read check Medium
Vega vulnerable to arbitrary code execution when clicking href links
Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.
npmvega
Read check MediumCWE-79
@braintree/sanitize-url Cross-site Scripting vulnerability
sanitize-url (aka @braintree/sanitize-url) before 6.0.1 allows XSS via HTML entities.
npm@braintree/sanitize-url
Read check HighCWE-1321
rangy vulnerable to Prototype Pollution
All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function uses recursive merge which can...
npmrangy
Read check HighCWE-94
xterm vulnerable to remote code execution
A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters.
npmxterm
Read check HighCWE-1321
mde utilities contains Prototype Pollution
All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.
npmutilities
Read check MediumCWE-79
Vega Expression Language `scale` expression function Cross Site Scripting - vega
The Vega scale expression function has the ability to call arbitrary functions with a single controlled argument. This can be exploited to escape the Vega...
npmvega
Read check MediumCWE-79
Vega Expression Language `scale` expression function Cross Site Scripting
The Vega scale expression function has the ability to call arbitrary functions with a single controlled argument. This can be exploited to escape the Vega...
npmvega-functions
Read check HighCWE-1321
dot-lens vulnerable to Prototype Pollution
All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.
npmdot-lens
Read check MediumCWE-79
Vega has Cross-site Scripting vulnerability in `lassoAppend` function - vega
Vega’s lassoAppend function: lassoAppend accepts 3 arguments and internally invokes push function on the 1st argument specifying array consisting of 2nd and 3rd arguments as...
npmvega
Read check MediumCWE-79
Vega has Cross-site Scripting vulnerability in `lassoAppend` function
Vega’s lassoAppend function: lassoAppend accepts 3 arguments and internally invokes push function on the 1st argument specifying array consisting of 2nd and 3rd arguments as...
npmvega-functions
Read check MediumCWE-79
rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters
When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of...
npmrsshub
Read check MediumCWE-696
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime
AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown.
npmjose-node-esm-runtime
Read check MediumCWE-696
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime
AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown.
npmjose-node-cjs-runtime
Read check HighCWE-22
Arbitrary local file read vulnerability during template rendering - swig-templates
Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.
npmswig-templates
Read check HighCWE-22
Arbitrary local file read vulnerability during template rendering
Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.
npmswig
Read check HighCWE-538
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend
angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a...
npmangular-server-side-configuration
Read check MediumCWE-203
Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime
AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown.
npmjose-browser-runtime
Read check MediumCWE-79
Content Injection via TileJSON Name in mapbox.js
Versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 of mapbox.js are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.
npmmapbox.js
Read check MediumCWE-79
Content Injection via TileJSON attribute in mapbox.js
Versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 of mapbox.js are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.
npmmapbox.js
Read check HighCWE-1321
matrix-js-sdk Prototype Pollution vulnerability
Events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer’s ability to process...
npmmatrix-js-sdk
Read check HighCWE-248
fastify/websocket vulnerable to uncaught exception via crash on malformed packet
Any application using @fastify/websocket could crash if a specific, malformed packet is sent.
npmfastify-websocket
Read check HighCWE-20
xmldom allows multiple root nodes in a DOM - xmldom
xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the...
npmxmldom
Read check HighCWE-20
xmldom allows multiple root nodes in a DOM
xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the...
npm@xmldom/xmldom
Read check MediumCWE-79
CKEditor 4.0 vulnerability in the HTML Data Processor
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a...
npmckeditor4
Read check HighCWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-g336-c7wv-8hp3
Affected versions of swagger-ui are vulnerable to cross-site scripting via the url query string parameter.
npmswagger-ui
Read check HighCWE-79
Cross-Site Scripting in @toast-ui/editor
Versions of @toast-ui/editor prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS). There are multiple bypasses to the package’s built-in XSS sanitization. This may allow...
npm@toast-ui/editor
Read check HighCWE-79
Cross-Site Scripting in bootstrap-vue
Versions of bootstrap-vue prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the...
npmbootstrap-vue
Read check HighCWE-94
Content Injection in remarkable
Versions 1.4.0 and earlier of remarkable are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of remarkable did not properly whitelist link...
npmremarkable
Read check MediumCWE-79
Cross-Site Scripting in webtorrent
Versions of webtorrent prior to 0.107.6 are vulnerable to Cross-Site Scripting. webtorrent servers started with torrent.createServer() lists a torrent’s title and files in the index...
npmwebtorrent
Read check MediumCWE-79
Cross-Site Scripting in c3
Affected versions of c3 are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips.
npmc3
Read check LowCWE-1022
Reverse Tabnabbing in showdown
Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the...
npmshowdown
Read check HighCWE-352
SvelteKit vulnerable to Cross-Site Request Forgery
The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different...
npm@sveltejs/kit
Read check MediumCWE-79
phoenix_html allows Cross-site Scripting in HEEx class attributes
tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes
npmphoenix_html
Read check MediumCWE-79
Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter
Cross-site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the editor parameter.
npmeditor.md
Read check MediumCWE-79
Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter
Cross-site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the <iframe> src parameter....
npmeditor.md
Read check HighCWE-1333
Regular Expression Denial of Service in hawk
Versions of hawk prior to 3.1.3, or 4.x prior to 4.1.1 are affected by a regular expression denial of service vulnerability related to excessively long...
npmhawk
Read check HighCWE-1333
Regular Expression Denial of Service in highcharts - highcharts
Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions....
npmhighcharts
Read check MediumCWE-1333
Denial of Service in protobufjs - protobufjs
Versions of protobufjs before 5.0.3 and 6.8.6 are vulnerable to a regular expression denial of service when parsing crafted invalid *.proto files.
npmprotobufjs
Read check LowCWE-1333
Regular Expression Denial of Service in clean-css
Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions....
npmclean-css
Read check LowCWE-1333
Regular Expression Denial of Service in marked - marked - GHSA-ch52-vgq2-943f
Affected versions of marked are vulnerable to Regular Expression Denial of Service (ReDoS). The _label subrule may significantly degrade parsing performance of malformed input.
npmmarked
Read check HighCWE-400
Regular Expression Denial of Service in moment
Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.
npmmoment
Read check HighCWE-755
Denial of Service in axios
Versions of axios prior to 0.18.1 are vulnerable to Denial of Service. If a request exceeds the maxContentLength property, the package prints an error but...
npmaxios
Read check HighCWE-918
SvelteKit framework has Insufficient CSRF protection for CORS requests
The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different...
npm@sveltejs/kit
Read check MediumCWE-327
Insecure Cryptography Algorithm in simple-crypto-js
Versions of simple-crypto-js prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the...
npmsimple-crypto-js
Read check High
Authentication Bypass in @strapi/plugin-users-permissions
Strapi through 4.5.6 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for...
npm@strapi/plugin-users-permissions
Read check MediumCWE-20
Improper Input Validation in sanitize-html
Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by...
npmsanitize-html
Read check MediumCWE-125
Out-of-bounds Read in base64url
Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x...
npmbase64url
Read check HighCWE-400
Switcher Client contains Regular Expression Denial of Service (ReDoS)
Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial...
npmswitcher-client
Read check MediumCWE-862
matrix-js-sdk vulnerable to invisible eavesdropping in group calls
An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk,...
npmmatrix-js-sdk
Read check MediumCWE-79
Cross-Site Scripting in @ckeditor/ckeditor5-link
Versions of status-board prior to 10.0.1 are vulnerable to Cross-Site Scripting. The _createPreviewButton() function fails to sanitize the href attribute of a created <a> tag....
npm@ckeditor/ckeditor5-link
Read check MediumCWE-79
Cross-site scripting vulnerability in TinyMCE - tinymce - GHSA-vrv8-v4w8-f95h
A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content...
npmtinymce
Read check MediumCWE-79
Cross-Site Scripting in react - react
Affected versions of react are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers...
npmreact
Read check HighCWE-1321
Prototype pollution in matrix-js-sdk (part 2)
In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-js-sdk functionality, causing denial...
npmmatrix-js-sdk
Read check MediumCWE-918
Server side request forgery in SwaggerUI - swagger-ui-dist
SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users...
npmswagger-ui-dist
Read check MediumCWE-918
Server side request forgery in SwaggerUI - swagger-ui-react
SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users...
npmswagger-ui-react
Read check MediumCWE-918
Server side request forgery in SwaggerUI
SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users...
npmswagger-ui
Read check MediumCWE-79
@claviska/jquery-minicolors vulnerable to Cross-site Scripting
jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names....
npm@claviska/jquery-minicolors
Read check MediumCWE-502
Deserialization of Untrusted Data in bson - bson
Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
npmbson
Read check HighCWE-918
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url
Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.
npmparse-url
Read check HighCWE-125
Out-of-bounds Read in atob
Versions of atob before 2.1.0 uninitialized Buffers when number is passed in input on Node.js 4.x and below.
npmatob
Read check HighCWE-918
Incorrect Authorization in @uppy/companion
@uppy/companion prior to version 3.3.1 is vulnerable to incorrect authorization. A user with URL upload access could enumerate internal companion server networks, send local webservers...
npm@uppy/companion
Read check HighCWE-755
Uncaught Exception in engine.io - engine.io
A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.
npmengine.io
Read check HighCWE-79
Cross-site scripting vulnerability in TinyMCE - tinymce - GHSA-27gm-ghr9-4v95
A cross-site scripting (XSS) vulnerability was discovered in: the core parser, paste and visualchars plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially...
npmtinymce
Read check MediumCWE-346
Leaking of user information on Cross-Domain communication in sysend
Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted.This is not a big impact because it...
npmsysend
Read check MediumCWE-79
@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability
Vendure provides an authorization system with different levels of privileges. For example, an administrator cannot create another administrator.
npm@vendure/admin-ui-plugin
Read check HighCWE-400
is_js vulnerable to Regular Expression Denial of Service
is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service...
npmis_js
Read check MediumCWE-79
Cross-Site Scripting in jquery - jquery
Affected versions of jquery are vulnerable to cross-site scripting. This occurs because the main jquery function uses a regular expression to differentiate between HTML and...
npmjquery
Read check High
RCE in SiteServer CMS
SiteServer CMS v7.x, which SiteServer UI relies on, allows attackers to execute arbitrary code via a crafted plug-in.
npmsiteserver
Read check HighCWE-400
semver-regex Regular Expression Denial of Service (ReDOS)
npm semver-regex is vulnerable to Inefficient Regular Expression Complexity
npmsemver-regex
Read check HighCWE-1321
jquery-plugin-query-object contains prototype pollution vulnerability
Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype.
npmjquery-query-object
Read check MediumCWE-319
Kibana Sensitive Data Disclosure
It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which may be...
npmkibana
Read check MediumCWE-915
eivindfjeldstad-dot contains prototype pollution vulnerability
eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function ‘set’ could be tricked into adding or modifying properties of ‘Object.prototype’ using a ‘proto’ payload.
npm@eivifj/dot
Read check HighCWE-20
Validation bypass in frourio
No description available.
npmfrourio
Read check HighCWE-20
Validation bypass in frourio-express
No description available.
npmfrourio-express
Read check High
Malicious Package in radicjs
Version 0.2.1 of radicjs contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmradicjs
Read check High
Malicious Package in pm-controls
Version 1.1.8 of pm-controls contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmpm-controls
Read check HighCWE-668
xdlocalstorage does not verify request origin
An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function...
npmxdlocalstorage
Read check LowCWE-1333
Regular expression denial of service in semver-regex
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input...
npmsemver-regex
Read check LowCWE-400
Regular Expression Denial of Service (ReDoS) in jsx-slack
jsx-slack v4.5.1 and earlier versions are vulnerable to a regular expression denial-of-service (ReDoS) attack.
npmjsx-slack
Read check MediumCWE-79
Possible inject arbitrary `CSS` into the generated graph affecting the container HTML
An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the generated graph,...
npmmermaid
Read check MediumCWE-834
JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-browser-runtime
The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c (PBES2 Count), which determines how many PBKDF2 iterations must be executed in...
npmjose-browser-runtime
Read check MediumCWE-834
JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-cjs-runtime
The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c (PBES2 Count), which determines how many PBKDF2 iterations must be executed in...
npmjose-node-cjs-runtime
Read check MediumCWE-834
JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-esm-runtime
The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c (PBES2 Count), which determines how many PBKDF2 iterations must be executed in...
npmjose-node-esm-runtime
Read check MediumCWE-834
JOSE vulnerable to resource exhaustion via specifically crafted JWE
The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c (PBES2 Count), which determines how many PBKDF2 iterations must be executed in...
npmjose
Read check MediumCWE-200
Potential exposure of tokens to an Unauthorized Actor
When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit...
npm@replit/crosis
Read check MediumCWE-400
Uncontrolled Resource Consumption in markdown-it
Special patterns with length > 50K chars can slow down parser significantly.
npmmarkdown-it
Read check MediumCWE-400
Denial of Service (DoS) vulnerability in RSSHub
Passing some special values to the filter and filterout parameters can cause an abnormally high CPU. Impact on the performance of the servers and RSSHub...
npmrsshub
Read check High
Malicious Package in leaflet-gpx
Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmleaflet-gpx
Read check High
Malicious Package in coffee-project
Version 1.7.5 of coffee-project contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmcoffee-project
Read check High
Malicious Package in ember-power-timepicker
Version 1.0.8 of ember-power-timepicker contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmember-power-timepicker
Read check High
Malicious Package in geoheat
Version 1.3.2 of geoheat contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmgeoheat
Read check High
Malicious Package in angular-location-update
Version 0.0.3 of angular-location-update contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmangular-location-update
Read check High
Malicious Package in libubx
Version 1.0.3 of libubx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmlibubx
Read check High
Malicious Package in jasmin
Version 0.0.3 of jasmin contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmjasmin
Read check High
Malicious Package in oauth-validator
Version 1.0.2 of oauth-validator contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmoauth-validator
Read check High
Malicious Package in react-dates-sc
Version 0.3.0 of react-dates-sc contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmreact-dates-sc
Read check High
Malicious Package in ngx-pica
Version 1.1.5 of ngx-pica contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmngx-pica
Read check High
Malicious Package in github-jquery-widgets
Version 0.1.2 of github-jquery-widgets contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmgithub-jquery-widgets
Read check High
Malicious Package in scroool
Version 0.1.7 of scroool contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmscroool
Read check High
Malicious Package in precode.js
Version 1.1.1 of precode.js contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmprecode.js
Read check High
Malicious Package in react-server-native
Version 0.0.7 of react-server-native contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmreact-server-native
Read check High
Malicious Package in mx-nested-menu
Version 0.1.30 of mx-nested-menu contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmmx-nested-menu
Read check High
Malicious Package in device-mqtt
Version 1.0.11 of device-mqtt contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmdevice-mqtt
Read check HighCWE-400
v8n vulnerable to Inefficient Regular Expression Complexity
Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) +...
npmv8n
Read check High
Malicious Package in radic-util
Version 1.0.2 of radic-util contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send...
npmradic-util
Read check HighCWE-1321
Prototype Pollution in backbone-query-parameters
Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.
npmbackbone-query-parameters
Read check MediumCWE-327
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal...
npmmatrix-js-sdk
Read check MediumCWE-79
@excalidraw/excalidraw Cross-site Scripting vulnerability
XSS vulnerability due to improperly sanitizing URLs of links that can be attached on canvas elements. This affects users of the npm package @excalidraw/excalidraw provided...
npm@excalidraw/excalidraw
Read check HighCWE-400
Prototype pollution in dotty
Prototype pollution vulnerability in ‘dotty’ before version 0.1.1 allows attackers to cause a denial of service and may lead to remote code execution.
npmdotty
Read check MediumCWE-1321
Prototype Pollution in lutils
All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.
npmlutils
Read check HighCWE-913
Prototype pollution in nestie
Prototype pollution vulnerability in ‘nestie’ versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution....
npmnestie
Read check MediumCWE-400
Regular Expression Denial of Service in browserslist
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
npmbrowserslist
Read check HighCWE-1333
steal vulnerable to Regular Expression Denial of Service via source and sourceWithComments
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal via the source and sourceWithComments variable in main.js.
npmsteal
Read check HighCWE-1333
steal Inefficient Regular Expression Complexity vulnerability via string variable
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.
npmsteal
Read check HighCWE-79
Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory
Angular Universal applications on 16.1.0 and 16.1.1 using critical CSS inlining are vulnerable to a cross-site scripting (XSS) attack where an attacker can trick another...
npm@nguniversal/common
Read check MediumCWE-79
Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation - materialize-css
In Materialize through 1.0.0, XSS is possible via the Toast feature.
npmmaterialize-css
Read check MediumCWE-79
Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation
In Materialize through 1.0.0, XSS is possible via the Toast feature.
npm@materializecss/materialize
Read check MediumCWE-79
Materialize-css vulnerable to Cross-site Scripting in tooltip component - materialize-css
All versions of materialize-css are vulnerable to Cross-Site Scripting. The tooltip component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript...
npmmaterialize-css
Read check MediumCWE-79
Materialize-css vulnerable to Cross-site Scripting in tooltip component
All versions of materialize-css are vulnerable to Cross-Site Scripting. The tooltip component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript...
npm@materializecss/materialize
Read check MediumCWE-79
Materialize-css vulnerable to Cross-site Scripting in autocomplete component - materialize-css
All versions of materialize-css are vulnerable to Cross-Site Scripting. The autocomplete component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript...
npmmaterialize-css
Read check MediumCWE-79
Materialize-css vulnerable to Cross-site Scripting in autocomplete component
All versions of materialize-css are vulnerable to Cross-Site Scripting. The autocomplete component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript...
npm@materializecss/materialize
Read check MediumCWE-79
dijit editor cross-site scripting vulnerability
dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.
npmdijit
Read check HighCWE-400
Regular Expression Denial of Service in jquery-validation
The GitHub Security Lab team has identified potential security vulnerabilities in jquery.validation.
npmjquery-validation
Read check HighCWE-1321
Prototype Pollution in js-data
All versions of package js-data prior to 3.0.10 are vulnerable to Prototype Pollution via the deepFillIn function.
npmjs-data
Read check MediumCWE-915
Prototype pollution in @tsed/core
This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on...
npm@tsed/core
Read check MediumCWE-79
Cross-site Scripting in markdown-it-highlightjs
This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature....
npmmarkdown-it-highlightjs
Read check HighCWE-94
Prototype Pollution in decal
This affects all versions of package decal. The vulnerability is in the extend function.
npmdecal
Read check HighCWE-400
Denial of service in prismjs
The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.
npmprismjs
Read check HighCWE-400
js-bson vulnerable to REDoS
The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS)...
npmbson
Read check HighCWE-1333
Inefficient Regular Expression Complexity in handsontable
The package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.
npmhandsontable
Read check HighCWE-284
rendertron can remotely shut down Chrome instance
Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET...
npmrendertron
Read check HighCWE-311
dalek-browser-chrome Downloads Resources over HTTP
Affected versions of dalek-browser-chrome insecurely download an executable over an unencrypted HTTP connection.
npmdalek-browser-chrome
Read check HighCWE-22
rendertron LFI vulnerability
Rendertron 1.0.0 allows for alternative protocols such as ‘file://’ introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote...
npmrendertron
Read check MediumCWE-79
rendertron XSS vulnerability
Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.
npmrendertron
Read check HighCWE-400
ReDoS via long UserAgent header in useragent
Affected versions of useragent are vulnerable to regular expression denial of service when an arbitrarily long User-Agent header is parsed.
npmuseragent
Read check MediumCWE-200
Invalid Curve Attack in node-jose
Affected versions of node-jose are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key...
npmnode-jose
Read check MediumCWE-327
Elliptic Uses a Broken or Risky Cryptographic Algorithm
The npm package elliptic before version 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that...
npmelliptic
Read check HighCWE-200
Rendertron discloses absolute paths of files
Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the “_where” attribute of...
npmrendertron
Read check MediumCWE-79
SimpleMDE XSS Vulnerability
SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled...
npmsimplemde
Read check MediumCWE-79
Svelte vulnerable to XSS when using objects during server-side rendering
The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects...
npmsvelte
Read check MediumCWE-79
Valine HTML Injection
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with...
npmvaline
Read check HighCWE-22
Directory Traversal in commentapp.stetsonwood
Affected versions of commentapp.stetsonwood resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside...
npmcommentapp.stetsonwood
Read check HighCWE-506
opencv.js is malware
opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
npmopencv.js
Read check HighCWE-78
Command injection in github-todos
naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by...
npmgithub-todos
Read check HighCWE-1333
steal vulnerable to Regular Expression Denial of Service via input variable
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal via the input variable in main.js.
npmsteal
Read check HighCWE-311
dalek-browser-ie downloads Resources over HTTP
Affected versions of dalek-browser-ie insecurely download an executable over an unencrypted HTTP connection.
npmdalek-browser-ie
Read check MediumCWE-601
URIjs Vulnerable to Hostname spoofing via backslashes in URL
If using affected versions to determine a URL’s hostname, the hostname can be spoofed by using a combination of backslash (\) and slash (/) characters...
npmurijs
Read check MediumCWE-94
Template Injection in jsrender
Affected versions of jsrender are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.
npmjsrender
Read check HighCWE-400
Regular Expression Denial of Service in marked - marked
Affected versions of marked are vulnerable to a regular expression denial of service.
npmmarked
Read check MediumCWE-79
Sanitization bypass using HTML Entities in marked
Affected versions of marked are susceptible to a cross-site scripting vulnerability in link components when sanitize:true is configured.
npmmarked
Read check HighCWE-915
Prototype Pollution in deephas
Prototype pollution vulnerability in ‘deephas’ versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
npmdeephas
Read check HighCWE-506
openssl.js is malware
The openssl.js package is a piece of malware that steals environment variables and sends them to attacker controlled locations.
npmopenssl.js
Read check MediumCWE-300
Insecure Defaults Allow MITM Over TLS in engine.io-client
Affected versions of engine.io-client do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks.
npmengine.io-client
Read check MediumCWE-79
Marked vulnerable to XSS from data URIs
marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
npmmarked
Read check MediumCWE-79
Cross-site scripting in jspdf - jspdf
Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It’s possible to inject JavaScript code via the html method.
npmjspdf
Read check MediumCWE-79
Cross-site scripting in jspdf
It’s possible to use nested script tags in order to bypass the filtering regex.
npmjspdf
Read check HighCWE-400
Regular Expression Denial of Service in content
Affected versions of content are vulnerable to a regular expression denial of service when parsing malicious Content-Type and Content-Disposition headers.
npmcontent
Read check MediumCWE-79
Cross-site Scripting in remarkable
In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.
npmremarkable
Read check HighCWE-77
Code injection in mock2easy
This affects all versions up to and including version 0.0.24 of package mock2easy. a malicious user could inject commands through the _data variable:
npmmock2easy
Read check MediumCWE-400
Regular Expression Denial of Service in postcss
The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in...
npmpostcss
Read check MediumCWE-79
Pandao editor.md vulnerable to DOM XSS
pandao Editor.md 1.5.0 has DOM XSS via input starting with a << substring, which is mishandled during construction of an A element.
npmeditor.md
Read check HighCWE-79
XSS in Data URI in remarkable
Affected versions of remarkable are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of data: URIs in links, and can therefore...
npmremarkable
Read check HighCWE-400
Regular Expression Denial of Service in decamelize
Affected versions of decamelize are susceptible to a denial of service vulnerability when user input is passed directly into decamelize.
npmdecamelize
Read check MediumCWE-79
Pandao editor.md vulnerable to XSS in IMG attributes
Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
npmeditor.md
Read check HighCWE-400
jspdf vulnerable to Regular Expression Denial of Service (ReDoS)
This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.
npmjspdf
Read check MediumCWE-20
netmask npm package mishandles octal input data
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in...
npmnetmask
Read check HighCWE-20
ejs is vulnerable to remote code execution due to weak input validation
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
npmejs
Read check MediumCWE-338
Cryptographically Weak PRNG in randomatic
Affected versions of randomatic generate random values using a cryptographically weak psuedo-random number generator. This may result in predictable values instead of random values as...
npmrandomatic
Read check HighCWE-20
ejs vulnerable to DoS due to weak input validation
nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in ejs.renderFile()
npmejs
Read check MediumCWE-1321
Prototype Pollution in sey
All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.
npmsey
Read check HighCWE-311
node-browser downloads Resources over HTTP
Affected versions of node-browser insecurely downloads resources over HTTP.
npmnode-browser
Read check MediumCWE-79
mde ejs vulnerable to XSS
nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
npmejs
Read check HighCWE-915
Prototype Pollution in field
Prototype pollution vulnerability in ‘field’ versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
npmfield
Read check MediumCWE-79
Cross-Site Scripting in sanitize-html - sanitize-html
Affected versions of sanitize-html are vulnerable to cross-site scripting when allowedTags includes at least one nonTextTag.
npmsanitize-html
Read check MediumCWE-79
Cross-Site Scripting in sanitize-html
Affected versions of sanitize-html are vulnerable to cross-site scripting.
npmsanitize-html
Read check MediumCWE-409
superagent vulnerable to zip bomb attacks
Affected versions of superagent do not check the post-decompression size of ZIP compressed HTTP responses prior to decompressing. This results in the package being vulnerable...
npmsuperagent
Read check MediumCWE-79
Cross-Site Scripting in i18next - i18next
Affected versions of i18next may fail to sanitize user input when certain configuration options are used. When using the .init method, passing interpolation options without...
npmi18next
Read check MediumCWE-79
Cross-Site Scripting in i18next
Affected versions of i18next allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.
npmi18next
Read check MediumCWE-79
Macro in MathJax running untrusted Javascript within a web browser
MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running...
npmmathjax
Read check HighCWE-200
Insecure template handling in Squirrelly
Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options...
npmsquirrelly
Read check HighCWE-400
Denial of service in three
This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors.
npmthree
Read check HighCWE-311
selenium-chromedriver Downloads Resources over HTTP
Affected versions of selenium-chromedriver insecurely download an executable over an unencrypted HTTP connection.
npmselenium-chromedriver
Read check MediumCWE-79
auth0-lock vulnerable to XSS via unsanitized placeholder property
Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the additionalSignUpFields customization option to add a checkbox to...
npmauth0-lock
Read check HighCWE-352
pym.js CSRF Vulnerability
NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross Site Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function.
npmpym.js
Read check HighCWE-506
d3.js is malware
The d3.js package is a piece of malware that steals environment variables and sends them to attacker controlled locations.
npmd3.js
Read check HighCWE-311
dalek-browser-ie-canary downloads Resources over HTTP
Affected versions of dalek-browser-ie-canary insecurely download an executable over an unencrypted HTTP connection.
npmdalek-browser-ie-canary
Read check HighCWE-22
Path Traversal in localhost-now
All versions of localhost-now are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served...
npmlocalhost-now
Read check HighCWE-915
Prototype Pollution in record-like-deep-assign
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
npmrecord-like-deep-assign
Read check HighCWE-347
RSA signature validation vulnerability on maleable encoded message in jsrsasign
Vulnerable jsrsasign will accept RSA signature with improper PKCS#1.5 padding.Decoded RSA signature value consists following form:01(ff...(8 or more ffs)...ff)00[ASN.1 OF DigestInfo]Its byte length must be...
npmjsrsasign
Read check HighCWE-522
Sensitive data exposure in NATS - nats
Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server;...
npmnats
Read check HighCWE-522
Sensitive data exposure in NATS
Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server;...
npmnats.ws
Read check HighCWE-400
Regular Expression Denial of Service in no-case
Affected versions of no-case are vulnerable to a regular expression denial of service when parsing untrusted user input.
npmno-case
Read check MediumCWE-79
bracket-template vulnerable to reflected XSS
bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template
npmbracket-template
Read check LowCWE-400
Regular Expression Denial of Service in jadedown
The jadedown package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in.
npmjadedown
Read check MediumCWE-79
Cross-site Scripting in React Draft Wysiwyg
react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is...
npmreact-draft-wysiwyg
Read check HighCWE-311
cloudpub-redis downloads Resources over HTTP
Affected versions of cloudpub-redis insecurely download an executable over an unencrypted HTTP connection.
npmcloudpub-redis
Read check MediumCWE-453
CORS misconfiguration in socket.io
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
npmsocket.io
Read check HighCWE-94
Code Injection in jsen
This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine....
npmjsen
Read check HighCWE-400
Regular Expression Denial of Service in djvalidator
All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@------------------------------------------------------------------------------------------------------------------------!.
npmdjvalidator
Read check HighCWE-22
Directory Traversal in rtcmulticonnection-client
Affected versions of rtcmulticonnection-client resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside...
npmrtcmulticonnection-client
Read check HighCWE-22
Directory Traversal in cyber-js
Affected versions of cyber-js resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside...
npmcyber-js
Read check HighCWE-22
Directory Traversal in xtalk
Affected versions of xtalk are vulnerable to directory traversal, allowing access to the filesystem by placing “../” in the URL.
npmxtalk
Read check HighCWE-79
XSS in hello.js
This affects the package hello.js before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation....
npmhellojs
Read check MediumCWE-200
Credential leak in react-native-fast-image
This affects all versions before version 8.3.0 of package react-native-fast-image. When an image with source= is loaded, all other subsequent images will use the same...
npmreact-native-fast-image
Read check HighCWE-502
Remote Code Execution in scratch-vm
MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the...
npmscratch-vm
Read check HighCWE-400
mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input
Affected versions of mime are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
npmmime
Read check HighCWE-311
selenium-wrapper downloads Resources over HTTP
Affected versions of selenium-wrapper insecurely download an executable over an unencrypted HTTP connection.
npmselenium-wrapper
Read check HighCWE-94
Code Injection in cryo
All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization.
npmcryo
Read check HighCWE-88
Arbitrary Code Execution in mathjs
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
npmmathjs
Read check HighCWE-400
Regular Expression Denial of Service in riot-compiler
Affected versions of riot-compiler are susceptible to a regular expression denial of service vulnerability.
npmriot-compiler
Read check HighCWE-22
mcstatic directory traversal vulnerability
A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system...
npmmcstatic
Read check MediumCWE-642
Bypassing Sanitization using DOM clobbering in html-janitor
All versions of html-janitor are vulnerable to cross-site scripting (XSS).
npmhtml-janitor
Read check MediumCWE-400
html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - html-parse-stringify
This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used...
npmhtml-parse-stringify
Read check MediumCWE-400
html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS)
This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used...
npmhtml-parse-stringify2
Read check MediumCWE-79
XSS in apexcharts
The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.
npmapexcharts
Read check HighCWE-400
Prototype pollution in gsap
There is a prototype pollution vulnerability in gsap which affects all versions before 3.6.0.
npmgsap
Read check MediumCWE-79
Cross-Site Scripting in html-janitor
Versions of html-janitor prior to 2.0.2 (all current versions) are vulnerable to cross-site scripting (XSS).
npmhtml-janitor
Read check HighCWE-22
Directory Traversal in fbr-client
Affected versions of fbr-client resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside...
npmfbr-client
Read check HighCWE-918
Server-Side Request Forgery in @uppy/companion
The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local...
npm@uppy/companion
Read check HighCWE-400
Regular Expression Denial of Service in timespan
Affected versions of timespan are vulnerable to a regular expression denial of service when parsing dates.
npmtimespan
Read check MediumCWE-345
Electron vulnerable to URL spoofing via PDFium
Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can...
npmElectron
Read check MediumCWE-79
Docsify XSS Vulnerability
This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods...
npmdocsify
Read check HighCWE-200
auth0-js Privilege Escalation Vulnerability
A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users’ tokens...
npmauth0-js
Read check HighCWE-295
tiny-json-http missing SSL certificate validation
brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected....
npmtiny-json-http
Read check HighCWE-79
DataTable Vulnerable to Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the...
npmdatatables
Read check HighCWE-22
Directory Traversal in datachannel-client
Affected versions of datachannel-client resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside...
npmdatachannel-client
Read check HighCWE-400
Prototype Pollution in asciitable.js
The package asciitable.js before 1.0.3 is vulnerable to Prototype Pollution via the main function.
npmasciitable.js
Read check MediumCWE-79
Cross-site Scripting in epubjs
managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.
npmepubjs
Read check MediumCWE-1321
jszip Vulnerable to Prototype Pollution
This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in...
npmjszip
Read check HighCWE-400
Regular Expression Denial of Service (ReDoS) - ssri
npm ssri 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely...
npmssri
Read check HighCWE-400
Regular Expression Denial of Service (ReDoS)
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker...
npmis-svg
Read check HighCWE-697
Inefficient Regular Expression Complexity in chalk/ansi-regex
ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.
npmansi-regex
Read check HighCWE-20
decode-uri-component vulnerable to Denial of Service (DoS)
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
npmdecode-uri-component
Read check MediumCWE-79
Cross-Site Scripting (XSS) in jquery
Affected versions of jquery interpret text/javascript responses from cross-origin ajax requests, and automatically execute the contents in jQuery.globalEval, even when the ajax request doesn’t contain...
npmjquery
Read check MediumCWE-79
hexo-admin plugin for Node.js XSS Vulnerability
The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post....
npmhexo-admin
Read check HighCWE-20
Cezerin Unauthorized Acces
Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer...
npmcezerin
Read check MediumCWE-79
jQuery-UI vulnerable to Cross-site Scripting in dialog closeText
Affected versions of jquery-ui are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the closeText parameter in...
npmjquery-ui
Read check MediumCWE-79
XSS in `*Text` options of the Datepicker widget in jquery-ui
Accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the...
npmjquery-ui
Read check HighCWE-670
bson-objectid contains Improper input validation
An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting...
npmbson-objectid
Read check MediumCWE-79
XSS in the `altField` option of the Datepicker widget in jquery-ui
Accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the...
npmjquery-ui
Read check HighCWE-116
dojox vulnerable to unescaped string injection
In Dojo Toolkit before 1.14.0, there is unescaped string injection in dojox/Grid/DataGrid.
npmdojox
Read check MediumCWE-79
Cross-Site Scripting in dojo
Affected versions of dojo are susceptible to a cross-site scripting vulnerability in the dijit.Editor and textarea components, which execute their contents as Javascript, even when...
npmdojo
Read check MediumCWE-79
Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-4f9m-pxwh-68hg
Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which...
npmswagger-ui
Read check MediumCWE-79
Cross-Site Scripting in diagram-js
Versions of diagram-js prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled...
npmdiagram-js
Read check HighCWE-20
Etherpad Lite Access Restriction Bypass
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
npmep_etherpad-lite
Read check MediumCWE-79
Angular Redactor XSS Vulnerability
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG...
npmangular-redactor
Read check MediumCWE-200
Converse.js Exposure of Sensitive Information
Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data...
npmconverse.js
Read check MediumCWE-79
Simditor XSS Vulnerability
Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element, as demonstrated by Firefox 54.0.1.
npmsimditor
Read check HighCWE-79
Cross-Site Scripting in swagger-ui - swagger-ui
Affected versions of swagger-ui are vulnerable to cross-site scripting. This vulnerability exists because swagger-ui automatically executes external Javascript that is loaded in via the url...
npmswagger-ui
Read check HighCWE-347
Cisco node-jose improper validation of JWT signature
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is...
npmnode-jose
Read check MediumCWE-20
Auth0 angular-jwt misinterprets allowlist as regex
Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain allowlist...
npmangular-jwt
Read check HighCWE-1321
keyget vulnerable to prototype pollution
Prototype pollution vulnerability in ‘keyget’ versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
npmkeyget
Read check HighCWE-1321
Grunt-karma vulnerable to prototype pollution
Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.
npmgrunt-karma
Read check MediumCWE-863
Xen Orchestra Mishandles Authorization
Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resourceSet.getAll data is which the attacker changes the...
npmxo-web
Read check MediumCWE-79
Docsify vulnerable to cross-site scripting due to mishandled encoding
docsify versions 4.12.1 and earlier are vulnerable to cross-site scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the "...
npmdocsify
Read check MediumCWE-79
mxGraph vulnerable to cross-site scripting in color field
mxGraph through 4.0.0, related to the draw.io Diagrams plugin before 8.3.14 for Confluence and other products, is vulnerable to cross-site scripting. draw.io Diagrams allows the...
npmmxgraph
Read check HighCWE-22
MJML vulnerable to path traversal
MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.
npmmjml
Read check MediumCWE-79
mxGraph vulnerable to cross-site scripting in setTooltips function
mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.
npmmxgraph
Read check HighCWE-611
mxGraph vulnerable to XXE attacks
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView....
npmmxgraph
Read check HighCWE-1333
rgb2hex vulnerable to inefficient regular expression complexity
A vulnerability was found in rgb2hex up to 0.1.5. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to...
npmrgb2hex
Read check HighCWE-1333
skeemas Inefficient Regular Expression Complexity vulnerability
A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the...
npmskeemas
Read check HighCWE-1333
is-url Inefficient Regular Expression Complexity vulnerability
A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is an unknown functionality of...
npmis-url
Read check HighCWE-1333
debug Inefficient Regular Expression Complexity vulnerability
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation...
npmdebug
Read check High
Cross-realm object access in Webpack 5
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted...
npmwebpack
Read check MediumCWE-79
EpicEditor XSS Vulnerability
EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML...
npmepiceditor
Read check HighCWE-94
Prototype Pollution leading to Remote Code Execution in superjson
This is critical vulnerability, as it allows to run arbitrary code on any server using superjson input, including a Blitz.js server, without prior authentication or...
npmsuperjson
Read check MediumCWE-20
Improper Input Validation in vriteio/vrite
Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0.
npm@vrite/sdk
Read check HighCWE-918
Server-Side Request Forgery (SSRF) in vriteio/vrite
Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0.
npm@vrite/sdk
Read check HighCWE-79
webmention.js Cross-site Scripting vulnerability
webmention.js prior to 0.5.5 is vulnerable to cross-site scripting.
npmwebmention.js
Read check HighCWE-200
Leaking sensitive user information still possible by filtering on private with prefix fields
Still able to leak private fields if using the t(number) prefix
npm@strapi/utils
Read check HighCWE-1321
progressbar.js vulnerable to Prototype Pollution
All versions of the package progressbar.js prior to 1.1.1 are vulnerable to Prototype Pollution via the function extend() in the file utils.js.
npmprogressbar.js
Read check MediumCWE-79
Jodit Editor vulnerable to cross-site scripting
Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component.
npmjodit
Read check MediumCWE-22
Path traversal vulnerability in gatsby-plugin-sharp
The gatsby-plugin-sharp plugin prior to versions 5.8.1 and 4.25.1 contains a path traversal vulnerability exposed when running the Gatsby develop server (gatsby develop).
npmgatsby-plugin-sharp
Read check MediumCWE-200
Making all attributes on a content-type public without noticing it - @strapi/utils
Anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it.
npm@strapi/utils
Read check MediumCWE-200
Making all attributes on a content-type public without noticing it
Anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it.
npm@strapi/strapi
Read check MediumCWE-79
layui vulnerable to cross-site scripting
A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler....
npmlayui
Read check HighCWE-79
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix
npm@dcl/single-sign-on-client
Read check MediumCWE-352
@builder.io/qwik-city Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
npm@builder.io/qwik-city
Read check MediumCWE-347
Cleartext Signed Message Signature Spoofing in openpgp
OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools:
npmopenpgp
Read check HighCWE-400
Chaijs/get-func-name vulnerable to ReDoS
The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks.
npmget-func-name
Read check MediumCWE-79
tarteaucitron.js vulnerable to Cross-site Scripting
Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.
npmtarteaucitronjs
Read check LowCWE-79
Cross-Site Scripting in serialize-to-js
Versions of serialize-to-js prior to 3.0.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect...
npmserialize-to-js
Read check HighCWE-287
Unauthorized Access to Private Fields in User Registration API - @strapi/plugin-users-permissions
| Name | Value ||———-|————————|| OS | Windows 11 || Version | 4.11.1 (node v16.14.2) || Database | mysql |
npm@strapi/plugin-users-permissions
Read check HighCWE-287
Unauthorized Access to Private Fields in User Registration API
| Name | Value ||———-|————————|| OS | Windows 11 || Version | 4.11.1 (node v16.14.2) || Database | mysql |
npm@strapi/strapi
Read check MediumCWE-79
TinyMCE XSS vulnerability in notificationManager.open API
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE’s unfiltered notification system, which is used in error handling....
npmtinymce
Read check MediumCWE-1321
antfu/utils vulnerable to prototype pollution
Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
npm@antfu/utils
Read check HighCWE-754
Feathers socket handler allows abusing implicit toString - @feathersjs/socketio
Feathers socket handler did not catch invalid string conversion errors like:
npm@feathersjs/socketio
Read check HighCWE-754
Feathers socket handler allows abusing implicit toString
Feathers socket handler did not catch invalid string conversion errors like:
npm@feathersjs/transport-commons
Read check MediumCWE-79
editor.md vulnerable to Cross-site Scripting
Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted markdown text.
npmeditor.md
Read check HighCWE-312
Strapi leaking sensitive user information by filtering on private fields
Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users.
npm@strapi/strapi
Read check HighCWE-74
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server.
npm@strapi/plugin-users-permissions
Read check MediumCWE-200
Cloudera HUE Account Enumeration
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.
npmgethue
Read check HighCWE-79
external-svg-loader Cross-site Scripting vulnerability
According to the docs, svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not...
npmexternal-svg-loader
Read check MediumCWE-770
Allocation of Resources Without Limits or Throttling in vriteio/vrite
Allocation of Resources Without Limits or Throttling in GitHub repository vriteio/vrite prior to 0.3.0.
npm@vrite/sdk
Read check MediumCWE-319
html inputs of type password recorded in plaintext when converted to text inputs
Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript “Show Password” button. This differs from...
npmhighlight.run
Read check MediumCWE-79
Svelecte item names vulnerable to execution of arbitrary JavaScript
Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be...
npmsvelecte
Read check Medium
Strapi does not verify the access or ID tokens issued during the OAuth flow
Strapi 3.2.1 until 4.6.0 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used...
npm@strapi/plugin-users-permissions
Read check MediumCWE-79
ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor
It has been discovered that the ckeditor-wordcount-plugin plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode.
npmckeditor-wordcount-plugin
Read check MediumCWE-284
When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id
If you used the apiPrefilter option of the @Entity decorator, by setting it to a function that returns a filter that prevents unauthorized access to...
npmremult
Read check MediumCWE-79
jquery-ui Tooltip widget vulnerable to XSS
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject...
npmjquery-ui
Read check HighCWE-1321
MrSwitch hello.js vulnerable to prototype pollution
A prototype pollution vulnerability in MrSwitch hello.js prior to version 1.18.8 allows remote attackers to execute arbitrary code via hello.utils.extend function.
npmhellojs
Read check HighCWE-248
Uncaught Exception in yaml
Uncaught Exception in GitHub repository eemeli/yaml starting at version 2.0.0-5 and prior to 2.2.2.
npmyaml
Read check MediumCWE-79
Joplin Cross-site Scripting vulnerability - joplin
Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
npmjoplin
Read check MediumCWE-79
Joplin Cross-site Scripting vulnerability
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
npmjoplin
Read check HighCWE-79
@udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme
Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links...
npm@udecode/plate-link
Read check HighCWE-79
Cross-Site Scripting in highcharts
Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize href values and does not restrict...
npmhighcharts
Read check HighCWE-94
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
npm@frangoteam/fuxa
Read check HighCWE-770
Strapi Improper Rate Limiting vulnerability - @strapi/plugin-users-permissions
There is a rate limit on the login function of Strapi’s admin screen, but it is possible to circumvent it.
npm@strapi/plugin-users-permissions
Read check HighCWE-770
Strapi Improper Rate Limiting vulnerability
There is a rate limit on the login function of Strapi’s admin screen, but it is possible to circumvent it.
npm@strapi/admin
Read check MediumCWE-200
Strapi may leak sensitive user information, user reset password, tokens via content-manager views - @strapi/utils
I can get access to user reset password tokens if I have the configure view permissions
npm@strapi/utils
Read check MediumCWE-200
Strapi may leak sensitive user information, user reset password, tokens via content-manager views
I can get access to user reset password tokens if I have the configure view permissions
npm@strapi/admin
Read check MediumCWE-362
`chainId` may be outdated if user changes chains as part of connection in @web3-react - @web3-react/coinbase-wallet
chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React()...
npm@web3-react/coinbase-wallet
Read check MediumCWE-362
`chainId` may be outdated if user changes chains as part of connection in @web3-react - @web3-react/eip1193
chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React()...
npm@web3-react/eip1193
Read check MediumCWE-362
`chainId` may be outdated if user changes chains as part of connection in @web3-react - @web3-react/metamask
chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React()...
npm@web3-react/metamask
Read check MediumCWE-362
`chainId` may be outdated if user changes chains as part of connection in @web3-react
chainId may be outdated if the user changes chains as part of the connection flow. This means that the value of chainId returned by useWeb3React()...
npm@web3-react/walletconnect
Read check MediumCWE-79
angular-ui-notification Cross-site Scripting vulnerability
angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.
npmangular-ui-notification
Read check HighCWE-200
Hidden fields can be leaked on readable collections in Payload
If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values...
npmpayload
Read check MediumCWE-416
Use-After-Free in puppeteer
Versions of puppeteer prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may...
npmpuppeteer
Read check HighCWE-1321
Prototype Pollution in NASA Open MCT
In NASA Open MCT (aka openmct) before commit 545a177 is subject to a prototype pollution which can occur via an import action.
npmopenmct
Read check MediumCWE-22
Gatsby develop server has Local File Inclusion vulnerability
The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the __file-code-frame and __original-stack-frame paths, exposed when running the...
npmgatsby
Read check MediumCWE-79
Margox Braft-Editor Cross-site Scripting Vulnerability
Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embed media feature.
npmbraft-editor
Read check MediumCWE-79
Potential for cross-site scripting in PostHog-js
Potential for cross-site scripting in posthog-js.
npmposthog-js
Read check LowCWE-200
matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms
It was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing...
npmmatrix-appservice-irc
Read check MediumCWE-400
graphql Uncontrolled Resource Consumption vulnerability
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file...
npmgraphql
Read check HighCWE-798
@nuxtlabs/github-module made Use of Hard-coded Credentials
https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes...
npm@nuxtlabs/github-module
Read check MediumCWE-79
Bootbox.js Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), confirm(),...
npmbootbox
Read check MediumCWE-79
TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin
A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer,...
npmtinymce
Read check MediumCWE-79
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and other APIs and plugins. Text nodes within specific parents are not...
npmtinymce
Read check MediumCWE-918
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user.
npm@sentry/nextjs
Read check MediumCWE-78
chromedriver Command Injection vulnerability
Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to...
npmchromedriver
Read check MediumCWE-79
NASA Open MCT Cross Site Scripting vulnerability
Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in...
npmopenmct
Read check MediumCWE-352
NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.
npmopenmct
Read check MediumCWE-400
Uncontrolled Resource Consumption in strapi
A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary...
npmstrapi-admin
Read check LowCWE-918
google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability
A Server-Side Request Forgery (SSRF) Vulnerability is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An attacker can...
npmgoogle-translate-api-browser
Read check HighCWE-212
Exposure of Sensitive Information in eventsource
When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application....
npmeventsource
Read check MediumCWE-697
uri-template-lite Regular Expression Denial of Service
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input...
npmuri-template-lite
Read check HighCWE-1321
Collection.js vulnerable to Prototype Pollution
Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/iterators/extend.js.
npmcollection.js
Read check HighCWE-1333
Regular expression denial of service in devcert
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input...
npmdevcert
Read check HighCWE-1321
dottie vulnerable to Prototype Pollution
Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in...
npmdottie
Read check Low
fast-xml-parser regex vulnerability patch could be improved from a safety perspective
This is a comment on https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw and the patches fixing it.
npmfast-xml-parser
Read check HighCWE-400
Regular Expression Denial of Service in Handlebars
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing...
npmhandlebars
Read check HighCWE-471
Prototype Pollution in handlebars - handlebars - GHSA-q42p-pg8m-cqh6
Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects’ prototype, thus allowing an attacker to execute arbitrary code...
npmhandlebars
Read check HighCWE-94
Arbitrary Code Execution in Handlebars - handlebars
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit...
npmhandlebars
Read check HighCWE-94
Remote code execution in handlebars when compiling templates
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source....
npmhandlebars
Read check HighCWE-400
Uncontrolled Resource Consumption in Hawk
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP...
npmhawk
Read check HighCWE-668
Validation Bypass in kind-of
Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check,...
npmkind-of
Read check HighCWE-1333
Inefficient Regular Expression Complexity in marked - marked
Denial of service.
npmmarked
Read check HighCWE-400
Inefficient Regular Expression Complexity in marked
Denial of service.
npmmarked
Read check HighCWE-400
ReDoS in normalize-url
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it...
npmnormalize-url
Read check HighCWE-1333
Inefficient Regular Expression Complexity in nth-check
There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.
npmnth-check
Read check HighCWE-1321
Prototype pollution in Plist before 3.0.5 can cause denial of service
Prototype pollution vulnerability via .parse() in Plist allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
npmplist
Read check HighCWE-1321
Prototype Pollution in protobufjs
The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until...
npmprotobufjs
Read check HighCWE-1321
Prototype Pollution in querystringify
A vulnerability was found in querystringify before 2.0.0. It’s possible to override built-in properties of the resulting query string object if a malicious string is...
npmquerystringify
Read check HighCWE-502
Code Execution Through IIFE in serialize-to-js
Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE).
npmserialize-to-js
Read check HighCWE-502
Insecure serialization leading to RCE in serialize-javascript
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function “deleteFunctions” within “index.js”.
npmserialize-javascript
Read check HighCWE-400
Uncontrolled Resource Consumption in trim-newlines
@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for...
npmtrim-newlines
Read check HighCWE-1321
underscore-keypath vulnerable to Prototype Pollution
Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() function. Exploiting this vulnerability is possible...
npmunderscore-keypath
Read check HighCWE-20
Incorrect protocol extraction via \r, \n and \t characters
\r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.
npmurijs
Read check HighCWE-639
Authorization Bypass Through User-Controlled Key in url-parse
url-parse prior to version 1.5.8 is vulnerable to Authorization Bypass Through User-Controlled Key.
npmurl-parse
Read check HighCWE-1321
Prototype Pollution in vConsole
vConsole was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.
npmvconsole
Read check MediumCWE-1333
Inefficient Regular Expression Complexity in validator.js
validator.js prior to 13.7.0 is vulnerable to Inefficient Regular Expression Complexity
npmvalidator
Read check HighCWE-295
Improper Certificate Validation in xmlhttprequest-ssl
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to...
npmxmlhttprequest-ssl
Read check HighCWE-94
xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection - xmlhttprequest
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into...
npmxmlhttprequest
Read check HighCWE-94
xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into...
npmxmlhttprequest-ssl
Read check HighCWE-506
Malicious Package in another-date-picker
Version 2.0.43 of another-date-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmanother-date-picker
Read check HighCWE-400
Denial of Service in markdown-it-toc-and-anchor
All versions of markdown-it-toc-and-anchor are vulnerable to Denial of Service. Parsing markdown containing **text**+\n@[toc] causes the application to enter and infinite loop.
npmmarkdown-it-toc-and-anchor
Read check HighCWE-287
Improper Key Verification in ipns
Versions 0.1.1 or 0.1.2 of ipns are vulnerable to improper key validation. This is due to the public key verification was not being performed properly,...
npmipns
Read check HighCWE-506
Malicious Package in another-date-range-picker
Version 4.1.48 of another-date-range-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the...
npmanother-date-range-picker
Read check MediumCWE-400
Denial of Service in ipfs-bitswap
Versions of ipfs-bitswap prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used...
npmipfs-bitswap
Read check HighCWE-20
URIjs Hostname spoofing via backslashes in URL
If using affected versions to determine a URL’s hostname, the hostname can be spoofed by using a backslash (\) character as part of the scheme...
npmurijs
Read check HighCWE-918
SSRF & Credentials Leak
nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. A previous vulnerability allowed an attacker to change the baseURL...
npmnuxt-api-party
Read check MediumCWE-22
Directory Traversal in evershop - @evershop/evershop - GHSA-4wrm-qmq2-5fjx
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the readDirSync function...
npm@evershop/evershop
Read check MediumCWE-79
Cross-site Scripting in evershop - @evershop/evershop - GHSA-2xcj-557c-hf8r
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy...
npm@evershop/evershop
Read check MediumCWE-79
Cross Site Scripting in evershop - @evershop/evershop
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted request to the ProductGrid...
npm@evershop/evershop
Read check HighCWE-22
Directory Traversal in evershop - @evershop/evershop
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the DELETE function...
npm@evershop/evershop
Read check MediumCWE-22
Directory Traversal in evershop
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the mkdirSync function...
npm@evershop/evershop
Read check MediumCWE-79
Cross-site Scripting in evershop
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin...
npm@evershop/evershop
Read check High
Code execution in evershop
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file.
npm@evershop/evershop
Read check HighCWE-787
DOS by abusing `fetchOptions.retry`.
nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. ofetch is used to send the requests.
npmnuxt-api-party
Read check MediumCWE-916
Buttercup allows attackers to obtain the hash of the master password
Buttercup allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/.
npmbuttercup
Read check MediumCWE-1321
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.
npmfast-xml-parser
Read check HighCWE-79
Cross-site Scripting in @spscommerce/ds-react
XSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been...
npm@spscommerce/ds-react
Read check HighCWE-1321
mockjs vulnerable to Prototype Pollution via the Util.extend function
All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute resolves to the...
npmmockjs
Read check MediumCWE-20
Cube API denial of service attack
It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.
npm@cubejs-backend/api-gateway
Read check MediumCWE-79
Cross-site Scripting in cesium
A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim’s browser via sending a crafted...
npmcesium
Read check HighCWE-79
HTML comments vulnerability allowing to execute JavaScript code
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.
npmckeditor4
Read check HighCWE-400
Sentry's Astro SDK vulnerable to ReDoS
A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry’s Astro SDK 7.78.0-7.86.0. Under certain conditions, this vulnerability allows an attacker to...
npm@sentry/astro
Read check HighCWE-327
bsock uses weak hashing algorithms
An issue was discovered in the bsock component of bcoin-org bcoin that allows remote attackers to obtain sensitive information via weak hashing algorithms in the...
npmbsock
Read check MediumCWE-79
Cross-site scripting vulnerability in TinyMCE - tinymce
A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a...
npmtinymce
Read check MediumCWE-79
Cross-site scripting vulnerability in TinyMCE plugins
A cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the image and link plugins. The vulnerability allowed arbitrary JavaScript execution when...
npmtinymce
Read check MediumCWE-79
Cross-site scripting vulnerability in TinyMCE
A cross-site scripting (XSS) vulnerability was discovered in the schema validation logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a...
npmtinymce
Read check MediumCWE-79
Layui cross-site scripting (XSS) vulnerability
layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.
npmlayui
Read check HighCWE-674
msgpackr's conversion of property names to strings can trigger infinite recursion
When decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop.
npmmsgpackr
Read check MediumCWE-287
botframework-connector vulnerable to Improper Authentication
A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability...
npmbotframework-connector
Read check HighCWE-639
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or getAuth() in the Pages Router.
npm@clerk/nextjs
Read check MediumCWE-532
react-native-mmkv Insertion of Sensitive Information into Log File vulnerability
Before version v2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by...
npmreact-native-mmkv
Read check MediumCWE-79
QooxDoo XSS in Callback Parameter
Cross-site scripting (XSS) vulnerability in framework/source/resource/qx/test/jsonp_primitive.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows...
npmqooxdoo
Read check MediumCWE-276
Incorrect Default Permissions in log4js
Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files...
npmlog4js
Read check HighCWE-20
Sending a GET or HEAD request with a body crashes SvelteKit
In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD...
npm@sveltejs/kit
Read check HighCWE-74
npm package rfc6902 vulnerable to Prototype Pollution
A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly...
npmrfc6902
Read check HighCWE-79
@urql/next Cross-site Scripting vulnerability
The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the...
npm@urql/next
Read check HighCWE-80
@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability
The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering...
npm@apollo/experimental-nextjs-app-support
Read check HighCWE-79
react-query-streamed-hydration Cross-site Scripting vulnerability
The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange...
npm@tanstack/react-query-next-experimental
Read check HighCWE-1333
MathJax Regular expression Denial of Service (ReDoS)
Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE:...
npmmathjax
Read check MediumCWE-284
@lobehub/chat vulnerable to unauthorized access to plugins
When the application is password-protected (deployed with the ACCESS_CODE option), it is possible to access plugins without proper authorization (without password).
npm@lobehub/chat
Read check HighCWE-916
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
No description available.
npmcrypto-js
Read check HighCWE-1321
shvl vulnerable to prototype pollution
Prototype pollution vulnerability in ‘shvl’ versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution....
npmshvl
Read check HighCWE-1321
dset vulnerable to prototype pollution
Prototype pollution vulnerability in ‘dset’ versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
npmdset
Read check MediumCWE-79
Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)
The Enhanced Image (aka image2) plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and...
npmckeditor-dev
Read check MediumCWE-79
Ckeditor XSS Vulnerability
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
npmckeditor
Read check HighCWE-94
Arbitrary Code Execution in handlebars
Versions of handlebars prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package’s lookup helper fails to properly validate templates, allowing attackers...
npmhandlebars
Read check MediumCWE-79
CKEditor cross-site scripting vulnerability in AJAX sample
The vulnerability has been discovered in the AJAX sample available at the samples/old/ajax.html file location. All integrators that use that sample in the production code...
npmckeditor4
Read check MediumCWE-79
ckeditor4 vulnerable to cross-site scripting
A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript...
npmckeditor4
Read check HighCWE-1333
Regular Expression Denial of Service in marked
Versions 0.3.3 and earlier of marked are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the...
npmmarked
Read check HighCWE-1333
Luxon Inefficient Regular Expression Complexity vulnerability
Luxon’s DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted...
npmluxon
Read check HighCWE-22
Stimulsoft Dashboard.JS directory traversal vulnerability
Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName...
npmstimulsoft-dashboards-js
Read check MediumCWE-79
Stimulsoft Dashboard.JS Cross Site Scripting vulnerability
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the...
npmstimulsoft-dashboards-js
Read check MediumCWE-1188
Default swagger-ui configuration exposes all files in the module
The default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module’s directory being exposed via http routes served by the...
npm@fastify/swagger-ui
Read check High
GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`
The GitHub Security Lab team has identified potential security vulnerabilities in scrypted.
npm@scrypted/core
Read check HighCWE-1321
Prototype Pollution in JSON5 via Parse Method
The parse method of the JSON5 library before and including version 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to...
npmjson5
Read check MediumCWE-116
Misinterpretation of malicious XML input - xmldom
xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes...
npmxmldom
Read check MediumCWE-116
Misinterpretation of malicious XML input
xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes...
npm@xmldom/xmldom
Read check HighCWE-203
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign
RSA PKCS#1.5 or RSAOAEP ciphertexts may be decrypted by this Marvin attack vulnerability.
npmjsrsasign
Read check HighCWE-1321
Starcounter-Jack JSON-Patch Prototype Pollution vulnerability
A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly...
npmfast-json-patch
Read check MediumCWE-79
CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature
The vulnerability has been discovered in the samples that use the preview feature:
npmckeditor4
Read check MediumCWE-79
Stimulsoft Dashboard.JS Cross Site Scripting vulnerability - stimulsoft-dashboards-js
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the...
npmstimulsoft-dashboards-js
Read check MediumCWE-79
CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection
The vulnerability has been discovered in the core HTML parsing module and may affect all editor instances that: Enabled full-page editing mode, or enabled CDATA...
npmckeditor4
Read check HighCWE-1321
JSONata expression can pollute the "Object" prototype
In JSONata versions >= 1.4.0, < 1.8.7 and >= 2.0.0, < 2.0.4, a malicious expression can use the transform operator to override properties on the...
npmjsonata
Read check HighCWE-74
TurboBoost Commands vulnerable to arbitrary method invocation
TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren’t as...
npm@turbo-boost/commands
Read check MediumCWE-79
Strapi 4.1.12 Cross-site Scripting via crafted file
An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After...
npm@strapi/strapi
Read check MediumCWE-79
RSSHub Cross-site Scripting vulnerability caused by internal media proxy
When the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of...
npmrsshub
Read check MediumCWE-918
RSSHub vulnerable to Server-Side Request Forgery
Serveral Server-Side Request Forgery (SSRF) vulnerabilities in RSSHub allow remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary...
npmrsshub
Read check HighCWE-89
SQL injection in typeORM
The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a...
npmtypeorm
Read check HighCWE-22
Path traversal in webpack-dev-middleware
No description available.
npmwebpack-dev-middleware
Read check MediumCWE-20
Cache Poisoning Vulnerability
An attacker controlling the second variable of the translate function is able to perform a cache poisoning attack. They can change the outcome of translation...
npmtranslate
Read check LowCWE-400
Regular Expression Denial of Service in debug
Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.
npmdebug
Read check MediumCWE-674
KaTeX's maxExpand bypassed by Unicode sub/superscripts
KaTeX users who render untrusted mathematical expressions could encounter malicious input using \def or \newcommand that causes a near-infinite loop, despite setting maxExpand to avoid...
npmkatex
Read check MediumCWE-116
KaTeX's `\includegraphics` does not escape filename
KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML.
npmkatex
Read check MediumCWE-184
KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols
Code that uses KaTeX’s trust option, specifically that provides a function to block-list certain URL protocols, can be fooled by URLs in malicious inputs that...
npmkatex
Read check HighCWE-639
OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation
A security vulnerability exists in oneuptime’s local storage handling, where a regular user can escalate privileges by modifying the is_master_admin key to true. This allows...
npm@oneuptime/model
Read check MediumCWE-79
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content loading and content inserting code. A SVG image could be loaded though an object or...
npmtinymce
Read check MediumCWE-79
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor.
npmtinymce
Read check MediumCWE-294
@workos-inc/authkit-nextjs session replay vulnerability
A user can reuse an expired session by controlling the x-workos-session header.
npm@workos-inc/authkit-nextjs
Read check MediumCWE-400
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - jose-node-cjs-runtime
A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. This...
npmjose-node-cjs-runtime
Read check MediumCWE-400
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - jose-node-esm-runtime
A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. This...
npmjose-node-esm-runtime
Read check MediumCWE-400
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext
A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. This...
npmjose
Read check MediumCWE-79
Formstone Vulnerable to Reflected XSS
Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files....
npmformstone
Read check HighCWE-400
MooTools Regular Expression Denial of Service
MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expression Denial...
npmmootools
Read check MediumCWE-79
jplayer Cross Site Scripting vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.
npmjplayer
Read check MediumCWE-79
jQuery-Upload-File XSS in fileNameStr
A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file...
npmjquery-file-upload
Read check HighCWE-1321
json-pointer vulnerable to Prototype Pollution
A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the...
npmjson-pointer
Read check HighCWE-697
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
Using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely...
npm@babel/traverse
Read check HighCWE-598
dectalk-tts Uses Unencrypted HTTP Request
In [email protected], network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers....
npmdectalk-tts
Read check MediumCWE-926
React Native Sms User Consent Intent Redirection Vulnerability
A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function...
npm@kyivstarteam/react-native-sms-user-consent
Read check MediumCWE-79
Summernote vulnerable to cross-site scripting
Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payload to the codeview parameter....
npmsummernote
Read check MediumCWE-280
Matrix IRC Bridge truncated content of messages can be leaked
The matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to...
npmmatrix-appservice-irc
Read check HighCWE-119
Handling untrusted input can result in a crash, leading to loss of availability / denial of service
Using particular inputs with @solana/web3.js will result in memory exhaustion (OOM).
npm@solana/web3.js
Read check LowCWE-1321
Prototype pollution in emit function
A prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key....
npmderby
Read check MediumCWE-79
Stored Cross-site Scripting (XSS) in excalidraw's web embed component
A stored XSS vulnerability in Excalidraw’s web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor...
npm@excalidraw/excalidraw
Read check MediumCWE-613
zcap has incomplete expiration checks in capability chains.
When invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the expires property is not properly...
npm@digitalbazaar/zcap
Read check HighCWE-89
Insufficient validation when decoding a Socket.IO packet - socket.io-parser
Due to improper type validation in the socket.io-parser library (which is used by the socket.io and socket.io-client packages to encode and decode Socket.IO packets), it...
npmsocket.io-parser
Read check MediumCWE-400
Regular Expression Denial Of Service in uri-js
Affected versions of uri-js is susceptible to a regular expression denial of service vulnerability when user input is sent to the .parse() method.
npmuri-js
Read check HighCWE-400
Regular Expression Denial of Service in remarkable
lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.
npmremarkable
Read check HighCWE-22
jqueryFileTree vulnerable to Directory Traversal
jqueryFileTree 2.1.5 and older is vulnerable to Directory Traversal
npmjqueryfiletree
Read check HighCWE-1321
Prototype pollution vulnerability in 'deep-set
The NPM module ‘deep-set’ can be abused by Prototype Pollution vulnerability since the function deepSet() does not check for the type of object before assigning...
npmdeep-set
Read check MediumCWE-1333
CKEditor 4 ReDoS Vulnerability
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input...
npmckeditor4-dev
Read check HighCWE-1321
mootools-more vulnerable to prototype pollution
Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in mootools-more 1.6.0 allows a malicious user to inject properties into Object.prototype.
npmmootools-more
Read check HighCWE-1333
Sanitize-html Vulnerable To REDoS Attacks
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment...
npmsanitize-html
Read check HighCWE-1321
deep-defaults vulnerable to prototype pollution
Prototype pollution vulnerability in ‘deep-defaults’ versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
npmdeep-defaults
Read check MediumCWE-79
Joplin vulnerable to Cross-site Scripting in notes
Joplin before 2.0.9 allows Cross-site Scripting via button and form in the note body.
npmjoplin
Read check HighCWE-94
Joplin Vulnerable to Code Injection
Joplin prior to version 2.7.1 allows remote attackers to execute system commands through malicious code in user search results.
npmjoplin
Read check MediumCWE-79
Joplin Vulnerable to Cross-site Scripting in Note Content
Joplin version prior to 1.0.90 contains a Cross-site Scripting (XSS) evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS...
npmjoplin
Read check MediumCWE-79
Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags
Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
npmjoplin
Read check HighCWE-20
Joplin Remote Code Execution
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via...
npmjoplin
Read check MediumCWE-79
MediaElement Vulnerable to Reflected XSS
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.swf in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or...
npmmediaelement
Read check HighCWE-915
Prototype Pollution in immer - immer - GHSA-c36v-fmgq-m8hx
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’).
npmimmer
Read check HighCWE-471
Prototype Pollution in immer - immer
Affected versions of immer are vulnerable to Prototype Pollution.
npmimmer
Read check HighCWE-843
Prototype Pollution in immer
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the...
npmimmer
Read check HighCWE-74
Server-Side Template Injection in formio
A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL. NOTE:...
npmformio
Read check HighCWE-78
Apache 2.4.49 Path Traversal and RCE
A vulnerability was discovered in Apache HTTP Server 2.4.49 related to changes made to path normalization. This flaw enables attackers to perform path traversal attacks,...
Path TraversalApacheRCEWeb ServerInjection
Read check HighCWE-79
Apache Expect Header Cross Site Scripting
Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....
ApacheXSSReflected-XSSInjection
Read check High
Apache mod_jk Access Control Bypass
The Apache Web Server (httpd) with Apache Tomcat JK (mod_jk) Connector versions 1.2.0 to 1.2.44 contains a flaw in path normalization, allowing specially crafted requests...
ApacheTomcatAccess Control
Read check MediumCWE-918
Apache mod_proxy 2.4.48 SSRF
A vulnerability exists in Apache HTTP Server 2.4.48 and earlier versions, specifically within the mod_proxy module. An attacker can exploit this flaw by crafting a...
SSRFApacheWeb Server
Read check MediumCWE-200
Apache server-info enabled
Exposing the Apache server-info page allows attackers to gather detailed information about the server configuration, installed modules, and other system-related details, aiding potential attacks.
Server MisconfigurationInformation DisclosureApache
Read check MediumCWE-200
Apache server-status enabled
Exposing the Apache server-status page allows attackers to gather detailed information about the server’s current state, facilitating potential attacks by revealing active connections, server uptime,...
Server MisconfigurationInformation DisclosureApache
Read check HighCWE-78
Apache Struts 2 Forced double OGNL evaluation S2-059
The Apache Struts framework, when forced, performs double evaluation of attributes’ values assigned to certain tags attributes such as id. This allows attackers to pass...
RCEStrutsInjection
Read check HighCWE-78
Apache Struts 2 RCE S2-045
Apache Struts 2 suffers from a Remote Code Execution (RCE) vulnerability, designated as S2-045. This vulnerability allows attackers to execute arbitrary commands on the server...
RCEStrutsInjection
Read check HighCWE-78
Apache Struts 2 REST plugin XStream RCE S2-052
Apache Struts 2, specifically the REST Plugin, is susceptible to a Remote Code Execution (RCE) vulnerability identified as S2-052. This vulnerability arises due to the...
RCEStrutsInjection
Read check HighCWE-78
Apache Struts OGNL expression RCE S2-057
A Remote Code Execution (RCE) attack is possible in Apache Struts when alwaysSelectFullNamespace is set to true (either by the user or by a plugin...
RCEStrutsInjection
Read check HighCWE-78
Apache Tomcat JSP Upload RCE
Apache Tomcat is susceptible to a Remote Code Execution (RCE) vulnerability when running on Windows with HTTP PUTs enabled. By sending a specially crafted request,...
RCETomcatInjection
Read check Medium
Apache Tomcat Manager Login Found
By default, the Tomcat Manager application should only be accessible from a browser running on the same machine as Tomcat. However, if the Manager login...
TomcatBrute ForceAccess ControlAuthentication
Read check InformationalCWE-200
Apache Version Disclosure
A misconfigured web server may expose the Apache version number either in the Server HTTP header or in the body of error pages. Attackers leverage...
HTTP HeadersInformation DisclosureServer MisconfigurationApacheWeb Server
Read check MediumCWE-209
Application and Database Error
An application and database error occurs when the application encounters issues related to both its functionality and interaction with the database backend. Unhandled exceptions in...
MySQLMariaDBPostgreSQLOracleSybaseMsAccessSQLiteMS SQLOLE DBODBCInformation DisclosureDenial of ServiceError Handling
Read check MediumCWE-209
Application Error
Unhandled exceptions pose two primary risks. Firstly, they can lead to denial of service by causing memory leaks or excessive resource consumption. Secondly, they may...
Information DisclosureDenial of ServiceError Handling
Read check HighCWE-540
Arbitrary Source Code Disclosure
Arbitrary Source Code Disclosure is a vulnerability that occurs when it’s possible to access the source code of any file on a web application, potentially...
Information DisclosureAccess Control
Read check InformationalCWE-200
ASP.NET Version Disclosure
The presence of the X-AspNet-Version and X-AspNetMvc-Version headers exposes the version of ASP.NET used by the web server, providing valuable information to attackers. This disclosure...
HTTP HeadersInformation DisclosureApplication MisconfigurationASP.NETWeb Server
Read check LowCWE-16
Auto Complete Enabled Password Input
Enabling autocomplete for password input fields allows browsers to save and autofill sensitive information, such as passwords. This poses a security risk, particularly on shared...
Application MisconfigurationData Security
Read check MediumCWE-319
Basic Authentication Over HTTP
Using Basic Authentication over HTTP exposes user credentials to potential interception by attackers who can sniff and capture HTTP traffic. This authentication method sends credentials...
AuthenticationEncryptionSSL/TLS
Read check HighCWE-78
Blind OS Command Execution
Blind OS Command Execution, also known as Command Injection, is a severe vulnerability that allows attackers to execute arbitrary commands on the host operating system...
Command InjectionRCEInput ValidationInjection
Read check HighCWE-89
Blind SQL Injection
Blind SQL Injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database without directly...
OracleSybaseMsAccessSQLiteSQL InjectionDatabaseInjection
Read check LowCWE-310
BREACH attack
BREACH is a variant of the CRIME attack that targets HTTP compression, specifically gzip or DEFLATE algorithms used via the content-encoding option within HTTP. Attackers...
BREACHCRIMECSRFSSL/TLSEncryptionServer Misconfiguration
Read check Informational
Broken Link
Broken hyperlinks in web pages can create a bad experience for the users. It can also affect the web page ranking in web search results....
SEOUser ExperienceWeb Development
Read check MediumCWE-307
Brute Force Prevention Bypassed
Brute Force Prevention Bypassed occurs when software lacks adequate measures to counter multiple failed authentication attempts within a short time frame, rendering it vulnerable to...
Brute ForceAuthenticationCAPTCHA
Read check MediumCWE-119
Buffer Overflow
Buffer overflow occurs when an application accepts more data than it can handle, leading to data overflowing the designated memory space. This vulnerability can be...
Buffer OverflowInput ValidationMemory Corruption
Read check InformationalCWE-16
Content Character Encoding is not Defined
When the character encoding is not explicitly defined in web content, browsers may resort to guessing or using a default encoding. This can lead to...
HTTP HeadersCharacter EncodingCross Site Scripting (XSS)Application Misconfiguration
Read check LowCWE-16
Content-Security-Policy Header is Missing
The absence of the Content-Security-Policy (CSP) response header leaves a website vulnerable to various types of attacks, including Cross-Site Scripting (XSS) and data injection attacks....
HTTP HeadersContent Security PolicyCross Site Scripting (XSS)Application Misconfiguration
Read check InformationalCWE-16
Cookie Accessible for Subdomains
The presence of the Domain attribute in the Set-Cookie header instructs browsers to send the cookie to any subdomains of the specified domain. This can...
HTTP HeadersCookieData SecurityApplication Misconfiguration
Read check LowCWE-16
Cookie without HttpOnly Flag
The absence of the HttpOnly flag in cookies allows JavaScript running on the client-side to access them through the Document.cookie API. This presents a security...
HTTP HeadersCookieCross Site Scripting (XSS)Application Misconfiguration
Read check LowCWE-16
Cookie without SameSite Flag
The absence of the SameSite flag in cookies leaves them vulnerable to cross-site request forgery (CSRF) attacks, where unauthorized actions are performed on behalf of...
HTTP HeadersCookieCross-Site Request ForgeryApplication Misconfiguration
Read check LowCWE-614
Cookie without Secure Flag
The absence of the Secure flag in cookies allows them to be transmitted over unencrypted connections, making them vulnerable to interception by attackers conducting man-in-the-middle...
HTTP HeadersSSL/TLSCookieMan-in-the-middle AttackApplication Misconfiguration
Read check LowCWE-310
CRIME (SPDY) attack
The CRIME (Compression Ratio Info-leak Made Easy) attack targets the SPDY protocol versions 3 and earlier, used in browsers like Mozilla Firefox and Google Chrome....
BREACHCRIMESSL/TLSEncryptionServer Misconfiguration
Read check LowCWE-310
CRIME (SSL/TLS) attack
CRIME (Compression Ratio Info-leak Made Easy) is a security exploit targeting secret web cookies transmitted over HTTPS and SPDY connections utilizing data compression. By analyzing...
BREACHCRIMESSL/TLSEncryptionServer Misconfiguration
Read check HighCWE-93
CRLF Injection in URL
CRLF injection involves injecting Carriage Return (ASCII 13, \r) and Line Feed (ASCII 10, \n) characters into web requests or responses. These characters are used...
CRLF InjectionHTTP Response SplittingInjection
Read check InformationalCWE-942
Cross-Origin Resource Sharing Allowed
Cross-Origin Resource Sharing (CORS) is a mechanism that uses additional HTTP headers to allow a web application running at one origin to access selected resources...
HTTP HeadersCORSApplication Misconfiguration
Read check HighCWE-79
Cross Site Scripting
Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....
XSSReflected-XSSInjection
Read check MediumCWE-209
Database Error
A database error occurs when the application encounters an issue while interacting with the database backend. Such errors can arise due to various factors, including...
MySQLMariaDBPostgreSQLOracleSybaseMsAccessSQLiteMS SQLOLE DBODBCInformation DisclosureDenial of ServiceError Handling
Read check MediumCWE-209
Detailed Application and Database Error
Detailed application and database errors occur when the application encounters issues related to both its functionality and interaction with the database backend. These errors expose...
MySQLMariaDBPostgreSQLOracleSybaseMsAccessSQLiteMS SQLOLE DBODBCInformation DisclosureDenial of ServiceError HandlingPHPASP.NETFlaskDjango
Read check MediumCWE-209
Detailed Application Error
Detailed application errors, caused by unhandled exceptions, pose two primary risks. Firstly, they can lead to denial of service by causing memory leaks or excessive...
PHPASP.NETFlaskDjangoInformation DisclosureDenial of ServiceError Handling
Read check LowCWE-548
Directory Listing of Sensitive Files
Directory listing of sensitive files occurs when directory listing, if enabled, exposes the complete index of resources within a directory to potential attackers. This can...
Information DisclosureDirectory ListingWeb Server
Read check LowCWE-548
Directory Listing
Directory listing, when enabled, exposes the complete index of resources within a directory to potential attackers. This can lead to unauthorized access to sensitive files...
Information DisclosureDirectory ListingWeb Server
Read check HighCWE-79
Drupal 4.1/4.2 XSS
Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....
DrupalXSSReflected-XSSInjection
Read check HighCWE-78
Drupal 'Drupalgeddon2' Remote Code Execution
A vulnerability in multiple subsystems of Drupal allows remote attackers to execute arbitrary operating system commands on the server, leading to potential compromise of the...
RCEDrupalInjection
Read check HighCWE-79
Drupal Module Cumulus Cross Site Scripting
Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....
DrupalXSSReflected-XSSInjection
Read check HighCWE-89
Drupal7 Pre Auth SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
DrupalSQLIInjection
Read check InformationalCWE-200
Email Address Disclosure
The disclosure of email addresses on webpages can make them vulnerable to harvesting by spambots, leading to an influx of unsolicited spam emails.
Information DisclosureSpam Prevention
Read check HighCWE-917
Expression Language Injection
Expression Language Injection (EL Injection) is a critical vulnerability that occurs when user inputs are used to construct dynamic expressions in web applications without proper...
EL InjectionTemplate InjectionInjection
Read check Informational
File Upload Functionality
The <input> element with type="file" enables users to select and upload files from their device storage to a remote server. However, unrestricted file upload functionality...
RiskFile UploadArbitrary File Upload
Read check MediumCWE-200
Hidden Resource in Robots.txt
Hidden resources in robots.txt refer to sensitive paths or directories that are inadvertently exposed in the robots.txt file. The robots.txt file is used to instruct...
Information DisclosureRobots Exclusion Standard
Read check Medium
Host Header Injection
During the processing of an incoming HTTP request, the web server relies on the Host HTTP header to determine which component or virtual host should...
Read check
High
HTTP Protocol Stack Remote Code Execution Vulnerability (DOS)
A vulnerability in the Microsoft Windows HTTP Protocol Stack (HTTP.sys) allows remote attackers to execute arbitrary code or cause a system crash on the host...
DOSWindows
Read check HighCWE-20
HTTP Response Splitting
HTTP response splitting is the result of the failure of a web application to properly sanitize CR (ASCII 0x0D) and LF (ASCII 0x0A) character in...
HTTP Response SplittingInjection
Read check HighCWE-502
Insecure Deserialization Remote Code Execution
Insecure deserialization remote code execution is a critical security vulnerability that occurs when an application deserializes a user-supplied object string without properly verifying its integrity....
Deserialization
Read check HighCWE-502
Insecure Deserialization
Insecure deserialization occurs when an application deserializes a user-supplied object string without properly verifying its integrity. This vulnerability enables attackers to manipulate the system state...
Deserialization
Read check MediumCWE-829
Insecure Inline Frame
When an inline frame tag (<iframe>) on a webpage references an external resource without the sandbox attribute set, it allows the external URL to manipulate...
Cross-Origin Resource Sharing
Read check MediumCWE-755
Internal Server Error
An internal server error occurs when the server encounters an unexpected condition that prevents it from fulfilling the request. This error can result from various...
Web ServerDenial of ServiceError Handling
Read check HighCWE-78
Joomla! 1.5 < 3.4.5 RCE
OS Command Execution, also known as Command Injection, is a severe vulnerability that allows attackers to execute arbitrary commands on the host operating system. Attackers...
JoomlaRCECommand InjectionInput ValidationInjection
Read check HighCWE-79
Joomla! < 1.7.0 XSS
Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....
JoomlaXSSReflected-XSSInjection
Read check HighCWE-89
Joomla! 3.2.1 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLIInjection
Read check HighCWE-89
Joomla! Component Advertisement Board 3.1.0 'catname' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component Aist 2.0 'id' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component AllVideos Reloaded 1.2.x 'divid' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component CcNewsletter 2.x.x 'id' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component Com_cbcontact 'contact_id' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component Com_contenthistory SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLIInjection
Read check HighCWE-89
Joomla! Component Com_fields 3.7 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLIInjection
Read check HighCWE-89
Joomla! Component com_hdwplayer 4.2 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLIInjection
Read check HighCWE-89
Joomla! Component Com_newsfeeds 1.0 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLIInjection
Read check HighCWE-89
Joomla! Component Com_rsgallery2 2.0 'catid' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component Com_shop 'editid' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component Com_shop 'id' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component DT Register 3.2.7 'id' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component Fastball 2.5 'season' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component File Download Tracker 3.0 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLIInjection
Read check HighCWE-89
Joomla! Component Form Maker 3.6.12 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLIInjection
Read check HighCWE-89
Joomla! Component Google Map Landkarten 4.2.3 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component InviteX 3.0.5 'invite_type' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component JB Bus 2.3 'order_number' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component JCK Editor 6.4.4 'parent' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component JCK Editor 6.4.4 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLIInjection
Read check HighCWE-89
Joomla! Component JEXTN Video Gallery 3.0.5 'id' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component JGive 2.0.9 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component Jobs Factory 2.0.4 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component JomEstate PRO 3.7 'id' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component JquickContact 1.3.2.2.1 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLIInjection
Read check HighCWE-89
Joomla! Component Music Collection 3.0.3 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component NextGen Editor 2.1.0 'plname' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component Odudeprofile 2.8 'profession' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component Reverse Auction Factory 4.3.8 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-89
Joomla! Component Timetable Responsive Schedule For Joomla! 1.5 'alias' SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check High
Joomla! 'J2Store < 3.3.7' SQL Injection
A vulnerability in the J2Store component for Joomla! allows attackers to inject and execute SQL commands on the website’s database, potentially leading to data theft,...
JoomlaSQL Injection
Read check HighCWE-89
Joomla! Pinterest Clone Social Pinboard 2.0 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
JoomlaSQLISQL InjectionDatabaseInjection
Read check HighCWE-98
Local File Inclusion
Local File Inclusion (LFI) is a vulnerability that allows attackers to include local files, exploiting dynamic file inclusion mechanisms in the target application. This occurs...
File InclusionPath TraversalInjection
Read check MediumCWE-200
Microsoft IIS Tilde Directory Enumeration
In some versions of Microsoft IIS, it is possible to detect the existence of files using an 8.3 short filename (SFN). This vulnerability allows attackers...
Information DisclosureIISDirectory ListingFile Disclosure
Read check InformationalCWE-525
Missing or Insecure Cache-Control Header
Web cache or HTTP cache is a system used to optimize web performance. Browsers cache the contents of a resource to reuse it on subsequent...
HTTP HeadersInformation DisclosureApplication Misconfiguration
Read check HighCWE-16
Nginx Code Execution due to Misconfiguration
Misconfigurations in Nginx, particularly with PHP FPM (FastCGI Process Manager), can lead to a critical security vulnerability. Attackers can exploit this misconfiguration by appending /.php...
Server MisconfigurationNginxArbitrary Code ExecutionPHP FPM
Read check HighCWE-200
Nginx Integer Overflow
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to an integer overflow vulnerability in the nginx range filter module. This vulnerability can...
Buffer OverflowInteger OverflowNginxInformation DisclosureWeb Server
Read check HighCWE-158
Nginx Null Byte Code Execution
Allowing null byte character (ASCII 0x00) in the URL can lead to a severe security risk. If the user can manipulate file contents on the...
NginxArbitrary Code ExecutionInput Validation
Read check HighCWE-20
Nginx Restriction Bypass via Space Character in URI
A vulnerability in Nginx allows attackers to bypass security restrictions in specific configurations by exploiting a flaw in request URI processing. When an unescaped space...
NginxSecurity BypassRequest Processing
Read check InformationalCWE-200
Nginx Version Disclosure
The Server header reveals detailed information about the server application handling the request, including the Nginx version. Exposing this information can aid attackers in identifying...
HTTP HeadersInformation DisclosureServer MisconfigurationNginxWeb Server
Read check MediumCWE-319
No HTTPS
In HTTP communications, traffic is not encrypted and can be captured by an attacker who has access to a network interface. This exposes sensitive information...
SSL/TLSData SecurityNetwork Security
Read check MediumCWE-311
No Redirection from HTTP to HTTPS
In scenarios where HTTPS is enabled but HTTP requests are not automatically redirected to HTTPS, users must explicitly use the HTTPS URL to ensure encrypted...
SSL/TLSEncryptionServer Misconfiguration
Read check LowCWE-530
Old/Backup Resource Found
Old or backup files left accessible on a web server can inadvertently expose sensitive information such as source code, administrative interfaces, or credentials. These files...
Information DisclosureBackup Files
Read check HighCWE-601
Open Redirection In URL
Unvalidated redirects and forwards occur when a web application accepts untrusted input that could redirect the user to a URL provided within the input. Attackers...
DjangoPythonURL RedirectionPhishing
Read check HighCWE-78
OS Command Execution
OS Command Execution, also known as Command Injection, is a severe vulnerability that allows attackers to execute arbitrary commands on the host operating system. Attackers...
Command InjectionRCEInput ValidationInjection
Read check LowCWE-319
Passive Mixed Content
When a user visits a page served over HTTPS, their connection with the web server is encrypted with TLS, protecting it from most sniffers and...
SSL/TLS
Read check MediumCWE-319
Password Input on HTTP
When passwords are sent over unencrypted HTTP traffic, attackers can intercept and capture them easily, leading to unauthorized access to user accounts, sensitive data exposure,...
Application MisconfigurationData SecurityNetwork SecurityAuthenticationEncryptionSSL/TLS
Read check MediumCWE-319
Password Sent in HTTP Query
When passwords are included in URLs and sent as part of HTTP queries, they may be logged in various places, including server logs, and disclosed...
Application MisconfigurationData SecurityNetwork SecurityAuthenticationEncryptionSSL/TLS
Read check LowCWE-598
Password Sent in Query
When passwords are included in URLs and sent as part of HTTP queries, they may be logged in various places, including server logs, and disclosed...
Application Misconfiguration
Read check MediumCWE-319
Password Sent Over HTTP
When passwords are sent over unencrypted HTTP traffic, attackers can intercept and capture them easily, leading to unauthorized access to user accounts, sensitive data exposure,...
Application MisconfigurationData SecurityNetwork SecurityAuthenticationEncryptionSSL/TLS
Read check InformationalCWE-200
Path Disclosure in Robots.txt
Path disclosure in robots.txt occurs when sensitive paths or directories are inadvertently exposed in the robots.txt file. The robots.txt file is used to instruct web...
Information DisclosureRobots Exclusion Standard
Read check InformationalCWE-200
PHP Version Disclosure
Exposing the PHP version used by the server facilitates attackers in identifying vulnerabilities more easily. This information exposes the server to potential risks.
HTTP HeadersInformation DisclosureApplication MisconfigurationPHPWeb Server
Read check MediumCWE-200
phpinfo() Found
The phpinfo() method in PHP reveals extensive details about the PHP environment, including configuration settings, server information, and installed extensions. While useful for debugging and...
Information DisclosurePHP
Read check HighCWE-89
Possible SQL Injection
Possible SQL Injection refers to a potential vulnerability where input data may be susceptible to SQL injection attacks. SQL injection is a type of attack...
MySQLMariaDBPostgreSQLOracleSybaseMsAccessSQLiteMS SQLOLE DBODBCSQL InjectionDatabaseInjection
Read check InformationalCWE-200
Private IPv4 Address Disclosure
Private IPv4 addresses are reserved for use within private networks such as local area networks (LANs). Revealing private IP addresses can provide insights into the...
Information DisclosureNetwork SecurityIP Addressing
Read check InformationalCWE-200
Private IPv6 Address Disclosure
Private IPv6 addresses are reserved for use within private networks and are not routable on the public Internet. Disclosing private IPv6 addresses can provide attackers...
Information DisclosureNetwork SecurityIP Addressing
Read check Informational
Profanity
The presence of profanity in web pages can create a negative user experience and may lead to decreased user engagement. Additionally, profanity can impact the...
SEOContent ModerationUser Experience
Read check InformationalCWE-16
Public-Key-Pins Header is Set
The HTTP Public-Key-Pins response header was used to associate a specific cryptographic public key with a web server to mitigate the risk of MITM attacks...
HTTP HeadersSSL/TLSCertificate TransparencyMan-in-the-middle AttackApplication Misconfiguration
Read check LowCWE-698
Redirection with Body
An HTTP redirection (3XX status code) typically does not include a body. However, if a body is present in the redirection response, it indicates that...
Information Disclosure
Read check InformationalCWE-16
Referrer-Policy Header is Missing
The Referrer-Policy HTTP header controls the amount of referrer information (sent via the Referer header) included with requests. The Referer header contains the address of...
HTTP HeadersPrivacyApplication Misconfiguration
Read check HighCWE-98
Remote File Disclosure
Remote File Disclosure (RFD) is a vulnerability that allows an attacker to disclose files located on remote servers, exploiting dynamic file inclusion mechanisms implemented in...
File InclusionSSRFInjection
Read check HighCWE-98
Remote File Inclusion
Remote File Inclusion (RFI) is a vulnerability that allows attackers to include remote files, exploiting dynamic file inclusion mechanisms in the target application. This occurs...
File InclusionSSRFInjection
Read check HighCWE-98
Remote URL Inclusion
Remote URL Inclusion (RUI) is a vulnerability that allows an attacker to include a remote URL, exploiting dynamic URL inclusion mechanisms implemented in the target...
File InclusionSSRFInjection
Read check InformationalCWE-200
Robots.txt Found
The robots.txt file is used to instruct web robots on which parts of a website to avoid crawling or indexing. While intended for cooperation with...
Information DisclosureRobots Exclusion Standard
Read check LowCWE-310
Secure Renegotiation is not supported
When a server does not support secure renegotiation in SSL/TLS connections, it becomes vulnerable to content injection at the start of sessions. This vulnerability requires...
Secure RenegotiationSSL/TLSContent InjectionServer Misconfiguration
Read check MediumCWE-530
Sensitive Old/Backup Resource Found
Sensitive Old/Backup Resource Found refers to old or backup files left accessible on a web server, which can inadvertently expose sensitive information such as source...
Information DisclosureBackup Files
Read check LowCWE-552
Sensitive Unreferenced Resource Found
Sensitive Unreferenced Resource Found refers to the discovery of sensitive resources within a web application that are not directly linked or referenced within the application...
Information Disclosure
Read check HighCWE-502
Serialized Object Found
Object serialization allows transferring complex data structures over channels like HTTP. However, the presence of a serialized object within the application indicates potential vulnerabilities related...
Deserialization
Read check LowCWE-200
Server Version Disclosure
The Server header describes the server application that handled the request. Detailed information in this header can expose the server to attackers. Using the information...
HTTP HeadersInformation DisclosureServer MisconfigurationWeb ServerTargeted AttacksUnauthorized Access
Read check LowCWE-16
Session Cookie Accessible for Subdomains
When the Domain attribute is present in the Set-Cookie header, browsers send the cookie to any subdomains of the specified domain. This can result in...
HTTP HeadersCookieData SecurityApplication Misconfiguration
Read check MediumCWE-16
Session Cookie without HttpOnly Flag
The absence of the HttpOnly flag in session cookies allows client-side JavaScript to access them, which poses a security risk. Without the HttpOnly flag, session...
HTTP HeadersCookieCross Site Scripting (XSS)Application Misconfiguration
Read check MediumCWE-16
Session Cookie without SameSite Flag
The absence of the SameSite flag in session cookies leaves them vulnerable to cross-site request forgery (CSRF) attacks, where unauthorized actions are performed on behalf...
HTTP HeadersCookieCross-Site Request ForgeryApplication Misconfiguration
Read check MediumCWE-614
Session Cookie without Secure Flag
The absence of the Secure flag in session cookies allows them to be transmitted over unencrypted connections, making them vulnerable to interception by attackers conducting...
HTTP HeadersSSL/TLSCookieMan-in-the-middle AttackApplication Misconfiguration
Read check MediumCWE-540
Source Code Disclosure
Source code disclosure occurs when the source code of a web application is inadvertently exposed to users, potentially revealing sensitive information such as credentials, API...
Information DisclosureAccess Control
Read check InformationalCWE-89
SQL Command Disclosure
SQL commands reveal information about the structure of the underlying database. This information does not create any direct impact on the target, though it provides...
Information DisclosureSQL InjectionDatabase
Read check HighCWE-89
SQL Injection
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
SQL InjectionDatabaseInjection
Read check HighCWE-326
SSL 2 enabled
SSL version 2 is known to have numerous security vulnerabilities, rendering it highly insecure and susceptible to attacks.
SSL/TLSEncryptionServer Misconfiguration
Read check MediumCWE-326
SSL 3 enabled
SSL version 3 is vulnerable to padding oracle attacks and other cryptographic weaknesses, making it insecure for use in secure communication.
SSL/TLSEncryptionServer Misconfiguration
Read check LowCWE-16
Strict-Transport-Security Header is Missing
The absence of the HTTP Strict-Transport-Security (HSTS) response header leaves a website vulnerable to protocol downgrade attacks and session hijacking. Without this header, attackers can...
HTTP HeadersSSL/TLSHTTPSSession HijackingApplication Misconfiguration
Read check LowCWE-353
Subresource Integrity is Missing
Subresource Integrity (SRI) is a security feature that allows browsers to verify that resources fetched, such as from a content delivery network (CDN), are delivered...
Subresource Integrity
Read check HighCWE-200
The Heartbleed Bug
Heartbleed is a critical security vulnerability found in the OpenSSL cryptography library, used for implementing the Transport Layer Security (TLS) protocol. Attackers can exploit this...
HeartbleedOpenSSLSSL/TLSInformation DisclosureMemory Leak
Read check MediumCWE-327
The POODLE attack
The POODLE attack (Padding Oracle On Downgraded Legacy Encryption) is a vulnerability that exploits SSL 3.0 fallback mechanisms in internet and security software clients. Attackers...
SSL/TLSDowngrade AttackEncryptionServer Misconfiguration
Read check HighCWE-78
The ShellShock Bug
Shellshock, also known as Bashdoor, is a critical vulnerability in the Unix Bash shell that allows attackers to execute arbitrary commands and gain unauthorized access....
ShellshockBashCommand InjectionUnixRCEInjection
Read check HighCWE-89
Time Based SQL Injection
Time Based SQL Injection is a type of SQL injection attack where the attacker manipulates the timing of SQL query execution to infer information about...
MySQLMariaDBMS SQL
Read check MediumCWE-326
TLS 1.0 enabled
TLS version 1.0 is known to have several security vulnerabilities and weaknesses, making it susceptible to attacks.
SSL/TLSEncryptionServer Misconfiguration
Read check LowCWE-326
TLS 1.1 enabled
TLS version 1.1 is known to have several security vulnerabilities and weaknesses, rendering it insecure for use.
SSL/TLSEncryptionServer Misconfiguration
Read check InformationalCWE-200
Tomcat Version Disclosure
Exposing detailed information such as the Tomcat version number facilitates attackers in identifying vulnerabilities and planning their attacks more effectively.
Information DisclosureServer MisconfigurationTomcatWeb Server
Read check LowCWE-16
TRACE Method Allowed
The HTTP TRACE method allows clients to view the entire request received by the web server, primarily for testing and diagnostic purposes. However, enabling this...
Server MisconfigurationWeb ServerCross-Site TracingHTTP
Read check LowCWE-16
TRACK Method Allowed
The HTTP TRACK and TRACE methods allow the client to see the entire request that the web server has received. Although primarily intended for testing...
Server MisconfigurationWeb ServerCross-Site TracingHTTP
Read check HighCWE-176
Unicode Transformation Issue
The Unicode Standard provides a unified encoding scheme for characters worldwide, enhancing program globalization and security. However, improper usage of Unicode can introduce security vulnerabilities,...
Unicode
Read check InformationalCWE-200
Unix Path Disclosure
File and directory paths reveal information about the structure of the file system of the underlying OS. While this information does not directly impact the...
Information DisclosureUnixData Security
Read check HighCWE-552
Unreferenced Repository Found
Unreferenced repositories, such as those from version control systems like Git, SVN, CVS, and Mercurial, contain valuable information such as source code, historical changes, and...
Information DisclosureVersion Control
Read check InformationalCWE-552
Unreferenced Resource Found
Unreferenced resources in web applications may reveal sensitive information and provide attackers with insights into potential attack vectors. These resources, although not directly linked or...
Information Disclosure
Read check HighCWE-540
Unreferenced Source Code Disclosure
Unreferenced Source Code Disclosure is a vulnerability that occurs when a backup file or source code file of an application is accessible to users, potentially...
Information DisclosureAccess Control
Read check HighCWE-601
Unvalidated Redirection
Unvalidated redirects and forwards occur when a web application accepts untrusted input that could redirect the user to a URL provided within the input. Attackers...
URL RedirectionPhishing
Read check MediumCWE-20
User Controllable URL
User-controllable URLs refer to HTML attributes with a value type of URI, such as href in the a tag or src in the img tag....
PhishingCross Site Scripting (XSS)Input Validation
Read check MediumCWE-209
User Enumeration
User Enumeration occurs when web applications inadvertently reveal whether a username exists on the system, either due to misconfiguration or design decisions. Attackers exploit this...
Information DisclosureBrute Force
Read check InformationalCWE-200
ViewState is not Encrypted
The ViewState, a hidden form input in ASP.NET pages, automatically persists information and application data specific to a page. If the ViewState is not encrypted,...
Information DisclosureApplication MisconfigurationASP.NETData Security
Read check HighCWE-521
Weak Password
Weak Password vulnerabilities arise when applications fail to enforce strong password policies, making it easier for attackers to guess or crack users’ passwords, leading to...
Password PolicyAuthenticationBrute Force
Read check HighCWE-22
Web Server Path Traversal
When a web server fails to properly normalize and validate the ../ sequence in URL paths, it enables attackers to access files outside the intended...
Path TraversalNodeJsExpressWeb Server
Read check MediumCWE-209
Werkzeug Interactive Debugging is Active
Werkzeug is a comprehensive WSGI web application library for the Python language. Werkzeug provides a WSGI middleware that renders nice tracebacks, optionally with an interactive...
Information DisclosureError HandlingFlaskPython
Read check InformationalCWE-200
Windows Path Disclosure
File and directory paths reveal information about the structure of the file system of the underlying OS. This information does not create any direct impact...
Information DisclosureWindowsData Security
Read check HighCWE-78
WordPress 4.6 Blind OS Command Execution
PHPMailer before 5.2.18 allows remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code. It is possible to execute remote...
WordpressRCEPHPMailerCommand InjectionInput ValidationInjection
Read check HighCWE-89
WordPress Plugin AdRotate 3.6.5 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin AdRotate 3.6.6 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin AdRotate 3.9.4 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin All Video Gallery 1.1 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Bannerize 2.8.6 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Bannerize 2.8.7 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Business Intelligence SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Chained Quiz 1.0.8 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Community Events 1.2.1 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin CP Multi View Event Calendar 1.01 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin CP Multi View Event Calendar 1.1.4 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin CP Multi View Event Calendar 1.1.7 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin DS FAQ 1.3.2 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Easy Contact Form Lite 1.0.7 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Event Registration 5.4.3 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Eventify Simple Events 1.7.f SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Facebook Promotions 1.3.3 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin File Groups 1.1.2 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin FireStorm Professional Real Estate 2.06.01 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Forum Server 1.7 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Glossary SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Google Document Embedder 2.5.14 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Google Document Embedder 2.5.16 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Hitasoft_player Ripe HD FLV Player 1.1 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Jetpack SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin JTRT Responsive Tables 4.1 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin KNR Author List Widget 2.0.0 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check High
WordPress Plugin LeagueManager 3.8 SQLI
An SQL Injection vulnerability exists in the league_id parameter of a function call made by the leaguemanager_export page.
WordpressSQL Injection
Read check HighCWE-89
WordPress Plugin Link Library 5.2.1 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin NEX Forms 3.0 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Olimometer 2.56 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin OQey Headers 0.3 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Paid Downloads 2.01 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Post Highlights 2.2 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin SCORM Cloud 1.0.6.6 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin SH Slideshow 3.1.4 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Smart Google Code Inserter 3.5 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Tune Library 2.17 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Users Ultra 1.5.50 Blind SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin VideoWhisper Video Presentation 1.1 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin WP Fastest Cache 0.8.4.8 Blind SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin WP Statistics 13.0.7 Time Based SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin WP Support Plus Responsive Ticket System 7.1.3 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-78
WordPress Plugin Wpfilemanager 6.8 RCE
OS Command Execution, also known as Command Injection, is a severe vulnerability that allows attackers to execute arbitrary commands on the host operating system. Attackers...
WordpressRCECommand InjectionInput ValidationInjection
Read check HighCWE-89
WordPress Plugin Yolink Search 1.1.4 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-89
WordPress Plugin Zotpress 4.4 SQLI
SQL injection is a type of attack where malicious SQL queries are inserted into input data, allowing attackers to manipulate the database. Successful exploitation can...
WordpressSQLIInjection
Read check HighCWE-79
WordPress Theme Akal XSS
Cross-Site Scripting (XSS) attacks occur when malicious scripts are injected into trusted websites, often through user inputs, and executed in the browsers of other users....
WordpressXSSReflected-XSSInjection
Read check MediumCWE-209
WordPress User Enumeration
User Enumeration occurs when web applications inadvertently reveal whether a username exists on the system, either due to misconfiguration or design decisions. Attackers exploit this...
WordpressInformation DisclosureBrute Force
Read check InformationalCWE-16
X-Content-Type-Options Header is Missing
The absence of the X-Content-Type-Options response HTTP header may expose a website to MIME sniffing attacks. MIME sniffing, performed by browsers when the MIME type...
HTTP HeadersMIME SniffingApplication Misconfiguration
Read check LowCWE-16
X-Frame-Options Header is Missing
The absence of the X-Frame-Options HTTP response header leaves a website vulnerable to click-jacking attacks. Without this header, attackers can embed the site’s content into...
HTTP HeadersClickjackingApplication Misconfiguration
Read check InformationalCWE-200
X-Powered-By Header Found
The presence of the X-Powered-By header reveals the technologies used by the web server, providing valuable information to attackers. This disclosure can aid attackers in...
HTTP HeadersInformation DisclosureApplication MisconfigurationWeb Server
Read check InformationalCWE-16
X-XSS-Protection Header is Set
The HTTP X-XSS-Protection response header, originally designed for Internet Explorer, Chrome, and Safari, aimed to mitigate reflected cross-site scripting (XSS) attacks. However, its effectiveness has...
HTTP HeadersCross-Site Scripting (XSS)Content Security PolicyApplication Misconfiguration
Read check HighCWE-611
@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability
XML External entity injections could be possible, when running the provided XML Validator on arbitrary input.
npm@cyclonedx/cyclonedx-library
Read check HighCWE-918
lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability
The latest version of lobe-chat(by now v0.141.2) has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack...
npm@lobehub/chat
Read check HighCWE-1321
json-schema-ref-parser Prototype Pollution issue
A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle(), parse(), resolve(),...
npm@apidevtools/json-schema-ref-parser
Read check LowCWE-79
vxe-table Cross-site Scripting vulnerability
A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9. This issue affects the function export of the file...
npmvxe-table
Read check HighCWE-94
Malicious PDF can inject JavaScript into PDF Viewer
The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then...
npmpdfjs-dist
Read check MediumCWE-79
Trix Editor Arbitrary Code Execution Vulnerability
The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with...
npmtrix
Read check HighCWE-94
javascript-deobfuscator crafted payload can lead to code execution
javascript-deobfuscator removes common JavaScript obfuscation techniques. Crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0.
npmjs-deobfuscator
Read check HighCWE-1321
Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - @conform-to/yup
Conform allows the parsing of nested objects in the form of object.property. Due to an improper implementation of this feature, an attacker can exploit it...
npm@conform-to/yup
Read check HighCWE-1321
Conform contains a Prototype Pollution Vulnerability in `parseWith...` function - @conform-to/zod
Conform allows the parsing of nested objects in the form of object.property. Due to an improper implementation of this feature, an attacker can exploit it...
npm@conform-to/zod
Read check HighCWE-1321
Conform contains a Prototype Pollution Vulnerability in `parseWith...` function
Conform allows the parsing of nested objects in the form of object.property. Due to an improper implementation of this feature, an attacker can exploit it...
npm@conform-to/dom
Read check HighCWE-80
ghtml Cross-Site Scripting (XSS) vulnerability
It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting (XSS) vulnerability in some cases.
npmghtml
Read check MediumCWE-248
@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling
A Denial-of-Service was found in the media upload process causing the server to crash without restarting, affecting either development and production environments.
npm@strapi/plugin-upload
Read check MediumCWE-79
SummerNote Cross Site Scripting Vulnerability
SummerNote 0.8.18 is vulnerable to Cross Site Scripting (XSS) via the Code View Function.
npmsummernote
Read check MediumCWE-918
Lobe Chat API Key Leak
If an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own...
npm@lobehub/chat
Read check MediumCWE-20
matrix-appservice-irc IRC command injection via admin commands containing newlines
It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands...
npmmatrix-appservice-irc
Read check HighCWE-1321
datatables.net vulnerable to Prototype Pollution due to incomplete fix
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
npmdatatables.net
Read check MediumCWE-915
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution...
npmajv
Read check MediumCWE-352
Axios Cross-Site Request Forgery Vulnerability
An issue discovered in Axios 0.8.1 through 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for...
npmaxios
Read check MediumCWE-79
Cross site scripting in datatables.net
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped....
npmdatatables.net
Read check HighCWE-1321
Prototype Pollution in async
A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user...
npmasync
Read check MediumCWE-80
Cross-site Scripting in ZenUML
Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS).
npm@zenuml/core
Read check MediumCWE-416
@fastly/js-compute has a use-after-free in some host call implementations
The implementation of the following functions were determined to include a use-after-free bug:
npm@fastly/js-compute
Read check HighCWE-400
glob-parent vulnerable to Regular Expression Denial of Service in enclosure regex
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
npmglob-parent
Read check HighCWE-1321
protobufjs Prototype Pollution vulnerability
protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used...
npmprotobufjs
Read check MediumCWE-1321
adolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults
adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. This vulnerability allows attackers to execute arbitrary code or cause a...
npm@adolph_dudu/ratio-swiper
Read check MediumCWE-1321
@akbr/update Prototype Pollution
akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.
npm@akbr/update
Read check HighCWE-1321
akbr patch-into was discovered to contain a prototype pollution via the function patchInto
akbr patch-into version 1.0.1 was discovered to contain a prototype pollution via the function patchInto. This vulnerability allows attackers to execute arbitrary code or cause...
npm@akbr/patch-into
Read check HighCWE-400
s3-url-parser vulnerable to Denial of Service via regexes component
s3-url-parser 1.0.3 is vulnerable to denial of service via the regexes component.
npms3-url-parser
Read check HighCWE-94
Blackprint @blackprint/engine Prototype Pollution issue
A Prototype Pollution issue in Blackprint @blackprint/engine 0.8.12 through 0.9.1 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.
npm@blackprint/engine
Read check HighCWE-400
Uncontrolled resource consumption in braces
The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious...
npmbraces
Read check MediumCWE-755
Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to
The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the...
npmmatrix-appservice-irc
Read check HighCWE-94
jsonic was discovered to contain a prototype pollution via the function empty.
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a...
npmjsonic
Read check HighCWE-434
Jan path traversal vulnerability - @janhq/core
An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. @janhq/core has...
npm@janhq/core
Read check HighCWE-287
EverShop vulnerable to improper authorization in GraphQL endpoints
Lack of authentication in NPM’s package @evershop/evershop before version 1.0.0-rc.9, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.
npm@evershop/evershop
Read check MediumCWE-1321
@cat5th/key-serializer Prototype Pollution vulnerability
harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function “query”. This vulnerability allows attackers to execute arbitrary code or cause a...
npm@cat5th/key-serializer
Read check HighCWE-400
Regular Expression Denial of Service in ms
Versions of ms prior to 0.7.1 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.
npmms
Read check HighCWE-624
(ReDoS) Regular Expression Denial of Service in tf2-item-format
Versions of tf2-item-format since at least 4.2.6 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input.
npmtf2-item-format
Read check MediumCWE-434
VvvebJs Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter...
npmvvvebJs
Read check MediumCWE-693
ejs lacks certain pollution protection
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
npmejs
Read check HighCWE-94
Badger Database Prototype Pollution
A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.
npm@abw/badger-database
Read check HighCWE-1321
obx Prototype Pollution
almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.
npm@almela/obx
Read check HighCWE-1321
@thi.ng/paths Prototype Pollution vulnerability
An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.
npm@thi.ng/paths
Read check MediumCWE-79
TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditable_regexp option, specially crafted HTML attributes containing malicious code were...
npmtinymce
Read check MediumCWE-79
TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s content parsing code. This allowed specially crafted noscript elements containing malicious code to be executed when...
npmtinymce
Read check HighCWE-79
Plate media plugins has a XSS in media embed element when using custom URL parsers
Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or...
npm@udecode/plate-media
Read check HighCWE-1321
jrburke requirejs vulnerable to prototype pollution
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a...
npmrequirejs
Read check MediumCWE-79
XSS vulnerability that affects bootstrap - bootstrap
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
npmbootstrap
Read check MediumCWE-79
XSS vulnerability that affects bootstrap
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
npmbootstrap-sass
Read check MediumCWE-79
Bootstrap Cross-site Scripting vulnerability - bootstrap - GHSA-4p24-vmcr-4gqj
In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different...
npmbootstrap
Read check MediumCWE-79
Bootstrap Cross-site Scripting vulnerability
In Bootstrap 2.x from 2.0.4, 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different...
npmbootstrap-sass
Read check MediumCWE-79
bootstrap Cross-site Scripting vulnerability - bootstrap-sass - GHSA-ph58-4vrj-w6hr
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
npmbootstrap-sass
Read check MediumCWE-79
bootstrap Cross-site Scripting vulnerability - bootstrap
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
npmbootstrap
Read check MediumCWE-79
Bootstrap vulnerable to Cross-Site Scripting (XSS)
In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.
npmbootstrap
Read check MediumCWE-94
Editor.js vulnerable to Code Injection
Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes...
npm@editorjs/editorjs
Read check MediumCWE-79
Scrypted Cross-site Scripting vulnerability
Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior (corresponding to @scrypted/core 0.1.142 and prior), a reflected cross-site scripting vulnerability...
npm@scrypted/core
Read check HighCWE-24
Nuxt Devtools has a Path Traversal: '../filedir
Nuxt Devtools is missing authentication on the getTextAssetContent RPC function which is vulnerable to path traversal. Combined with a lack of Origin checks on the...
npm@nuxt/devtools
Read check HighCWE-918
Nuxt Icon affected by a Server-Side Request Forgery (SSRF)
nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/_nuxt_icon/[name].
npm@nuxt/icon
Read check HighCWE-1321
@75lb/deep-merge Prototype Pollution vulnerability
Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge...
npm@75lb/deep-merge
Read check HighCWE-1321
robinweser fast-loops vulnerable to prototype pollution
robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a...
npmfast-loops
Read check MediumCWE-79
Cross-site Scripting in quill
A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute...
npmquill
Read check HighCWE-918
Server-Side Request Forgery in axios
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
npmaxios
Read check HighCWE-31
Jan path traversal vulnerability - @janhq/core - GHSA-5jqc-qj57-4hrc
Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.
npm@janhq/core
Read check MediumCWE-79
Trix has a cross-site Scripting vulnerability on copy & paste
The Trix editor, versions prior to 2.1.4, is vulnerable to XSS when pasting malicious code. This vulnerability is a bypass of the fix put in...
npmtrix
Read check HighCWE-94
Jan path traversal vulnerability
An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.
npm@janhq/core
Read check HighCWE-79
gettext.js has a Cross-site Scripting injection
Possible vulnerability to XSS injection if .po dictionary definition files is corrupted
npmgettext.js
Read check Medium
Vulnerable IIS Version
The Internet Information Services (IIS) version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the...
IISWeb ServerOutdated
Read check HighCWE-26
React Native Document Picker Directory Traversal vulnerability
Directory Traversal vulnerability in React Native Document Picker before 8.2.2 and 9.x before 9.1.1 allows a local attacker to execute arbitrary code via a crafted...
npmreact-native-document-picker
Read check HighCWE-1321
MiguelCastillo @bit/loader Prototype Pollution issue
A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argument in index.js.
npm@bit/loader
Read check MediumCWE-674
matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor
A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk’s getRoomUpgradeHistory function will infinitely recurse in...
npmmatrix-js-sdk
Read check HighCWE-94
squirrelly Code Injection vulnerability
squirrellyjs squirrelly v9.0.0 was discovered to contain a code injection vulnerability via the component options.varName. The issue was fixed in version 9.1.0.
npmsquirrelly
Read check MediumCWE-1321
ag-grid packages vulnerable to Prototype Pollution - @ag-grid-enterprise/charts
ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial...
npm@ag-grid-enterprise/charts
Read check MediumCWE-1321
ag-grid packages vulnerable to Prototype Pollution - ag-grid-enterprise
ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial...
npmag-grid-enterprise
Read check MediumCWE-1321
ag-grid packages vulnerable to Prototype Pollution
ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial...
npmag-grid-community
Read check HighCWE-79
Cross-site scripting in Swagger-UI
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based...
npmswagger-ui
Read check MediumCWE-79
VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability
A reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.5 allows remote attackers to execute arbitrary code and obtain sensitive information via the action...
npmvvvebjs
Read check MediumCWE-79
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
npmsvelte
Read check MediumCWE-79
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS
We discovered a DOM Clobbering vulnerability in Webpack’s AutoPublicPathRuntimeModule. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages...
npmwebpack
Read check MediumCWE-1333
ReDoS in urlregex
A vulnerability was found in nescalante urlregex up to 0.5.0 and classified as problematic. This issue affects some unknown processing of the file index.js of...
npmurlregex
Read check HighCWE-1321
Prototype pollution in ag-grid-community via the _.mergeDeep function - ag-grid-enterprise
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or...
npmag-grid-enterprise
Read check HighCWE-1321
Prototype pollution in ag-grid-community via the _.mergeDeep function
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or...
npmag-grid-community
Read check MediumCWE-1333
Zod denial of service vulnerability
Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails.
npmzod
Read check MediumCWE-656
Unreferenced Login Page Found
Unreferenced Login Page Found refers to the discovery of login pages within a web application that are not directly linked or referenced within the application...
AuthenticationBrute ForceInformation Disclosure
Read check Medium
WordPress Login Page Found
WordPress wp-login.php serves as the primary login page for both users and administrators. Attackers commonly exploit this page through password guessing and brute force attacks...
WordpressBrute ForceDenial of ServiceAuthentication
Read check HighCWE-1321
dset Prototype Pollution vulnerability
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the...
npmdset
Read check MediumCWE-79
DOM clobbering could escalate to Cross-site Scripting (XSS) - @pagefind/default-ui
Pagefind initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script you load. This information is gathered by looking up...
npm@pagefind/default-ui
Read check MediumCWE-79
DOM clobbering could escalate to Cross-site Scripting (XSS) - pagefind
Pagefind initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script you load. This information is gathered by looking up...
npmpagefind
Read check MediumCWE-79
DOM clobbering could escalate to Cross-site Scripting (XSS)
Pagefind initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script you load. This information is gathered by looking up...
npm@pagefind/modular-ui
Read check MediumCWE-79
DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS
Hi, Rspack|Webpack developer team!
npm@rspack/core
Read check HighCWE-79
Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes
One longstanding feature of Plate is the ability to add custom DOM attributes to any element or leaf using the attributes property. These attributes are...
npm@udecode/plate-core
Read check HighCWE-77
json-logic-js Command Injection vulnerability
A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js....
npmjson-logic-js
Read check HighCWE-78
PHP CGI Argument Injection RCE
In PHP, when configured as a CGI script (php-cgi), improper handling of certain query strings can allow remote attackers to execute arbitrary code. Specifically, query...
PHPCommand InjectionRCEInput ValidationInjection
Read check HighCWE-98
FUXA vulnerable to Local File Inclusion
FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log
npm@frangoteam/fuxa
Read check HighCWE-470
StimulusReflex arbitrary method call
More methods than expected can be called on reflex instances. Being able to call some of them has security implications.
npmstimulus_reflex
Read check MediumCWE-400
Denial of service in rocket chat message parser
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). Attackers who craft messages with specific characters may crash...
npm@rocket.chat/message-parser
Read check MediumCWE-79
Layui has DOM Clobbering gadgets that leads to Cross-site Scripting
A DOM Clobbering vulnerability has been discovered in layui that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., img...
npmlayui
Read check HighCWE-79
DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
We discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code...
npmrollup
Read check MediumCWE-918
lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
SSRF protection implemented in https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides external malicious url which redirects to internal resources like...
npm@lobehub/chat
Read check MediumCWE-79
Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting
Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.
npmflowise-embed
Read check HighCWE-1321
uPlot Prototype Pollution vulnerability
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to...
npmuplot
Read check MediumCWE-79
Stored XSS in Jupyter nbdime - nbdime
Improper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.
npmnbdime
Read check MediumCWE-79
Stored XSS in Jupyter nbdime
Improper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.
npmnbdime-jupyterlab
Read check HighCWE-787
Heap-based Buffer Overflow in sqlite-vec
sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Service (DoS)...
npmsqlite-vec
Read check MediumCWE-913
Sentry SDK Prototype Pollution gadget in JavaScript SDKs
In case a Prototype Pollution vulnerability is present in a user’s application or bundled libraries, the Sentry SDK could potentially serve as a gadget to...
npm@sentry/browser
Read check HighCWE-78
@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plug
When creating a new plugin using the git source, the user-controlled value req.body.name is used to build the plugin directory where the location will be...
npm@saltcorn/plugins-loader
Read check HighCWE-1321
@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst
The endpoint /site-structure/localizer/save-string/:lang/:defstring accepts two parameter values: lang and defstring. These values are used in an unsafe way to set the keys and value of...
npm@saltcorn/server
Read check MediumCWE-548
@saltcorn/server arbitrary file and directory listing when accessing build mobile app results
A user with admin permission can read arbitrary file and directory names on the filesystem by calling the admin/build-mobile-app/result?build_dir_name= endpoint. The build_dir_name parameter is not...
npm@saltcorn/server
Read check MediumCWE-22
@saltcorn/server arbitrary file zip read and download when downloading auto backups
A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file...
npm@saltcorn/server
Read check HighCWE-918
Strapi Server-Side Request Forgery (SSRF)
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or...
npm@strapi/strapi
Read check MediumCWE-79
Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page
Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.
npm@saltcorn/server
Read check HighCWE-22
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability
A logged-in user with any role can delete arbitrary files on the filesystem by calling the sync/clean_sync_dir endpoint. The dir_name POST parameter is not validated/sanitized...
npm@saltcorn/server
Read check LowCWE-79
ReLaXed Cross-site Scripting vulnerability
A vulnerability classified as problematic has been found in RelaxedJS ReLaXed up to 0.2.2. Affected is an unknown function of the component Pug to PDF...
npmrelaxedjs
Read check MediumCWE-79
Cross-Site Scripting in jquery
Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove <script> HTML tags that contain a...
npmjquery
Read check HighCWE-400
fast-xml-parser vulnerable to ReDOS at currency parsing
A ReDOS that exists on currency.js was discovered by Gauss Security Labs R&D team.
npmfast-xml-parser
Read check HighCWE-434
angular-base64-upload vulnerable to unauthenticated remote code execution
angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploitation of this vulnerability involves uploading arbitrary file content...
npmangular-base64-upload
Read check MediumCWE-79
Cross-site scripting (XSS) in the clipboard package - ckeditor5
During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package.
npmckeditor5
Read check MediumCWE-79
Cross-site scripting (XSS) in the clipboard package
During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 clipboard package.
npm@ckeditor/ckeditor5-clipboard
Read check MediumCWE-79
Cross site scripting in markdown-to-jsx
Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input sanitization. An attacker can...
npmmarkdown-to-jsx
Read check HighCWE-287
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
In matrix-js-sdk versions 9.11.0 through 34.7.0, the method MatrixClient.sendSharedHistoryKeys is vulnerable to interception by malicious homeservers. The method implements functionality proposed in MSC3061 and can...
npmmatrix-js-sdk
Read check HighCWE-190
Signature Malleabillity in elliptic
The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading ‘\0’ bytes, or integer overflows. This could conceivably...
npmelliptic
Read check MediumCWE-79
Slim Select has potential Cross-site Scripting issue
Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the user-provided Options object is...
npmslim-select
Read check HighCWE-354
secp256k1-node allows private key extraction over ECDH
In elliptic-based version, loadUncompressedPublicKey has a check that the public key is on the curve: https://github.com/cryptocoinjs/secp256k1-node/blob/6d3474b81d073cc9c8cc8cfadb580c84f8df5248/lib/elliptic.js#L37-L39
npmsecp256k1
Read check MediumCWE-80
Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
This can be leveraged to gain access to higher-privilege endpoints, e.g. if you get a user with admin privileges to run the code, you can...
npm@umbraco-cms/backoffice
Read check HighCWE-1395
Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify
The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674, potentially resulting in an XSS...
npmmermaid
Read check LowCWE-1333
ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function
The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially...
npmvue
Read check MediumCWE-1333
Knwl.js Regular Expression Denial of Service vulnerability
Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or...
npmknwl.js
Read check MediumCWE-209
Generation of Error Message Containing Sensitive Information in zsa
All users are impacted. The zsa application transfers the parse error stack from the server to the client in production build mode. This can potentially...
npmzsa
Read check LowCWE-89
@langchain/community SQL Injection vulnerability
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection.
npm@langchain/community
Read check MediumCWE-29
Langchain Path Traversal vulnerability
A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite...
npmlangchain
Read check MediumCWE-79
Glossarizer Cross-site Scripting vulnerability
Glossarizer through 1.5.2 improperly tries to convert text into HTML. Even though the application itself escapes special characters (e.g., <>), the underlying library converts these...
npmglossarizer
Read check HighCWE-94
lilconfig Code Injection vulnerability
Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the...
npmlilconfig
Read check MediumCWE-79
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized...
npmjquery
Read check LowCWE-532
@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled
Refresh tokens are logged to the console when the disabled by default debug flag, is enabled.
npm@workos-inc/authkit-nextjs
Read check HighCWE-79
happy-dom allows for server side code to be executed by a <script> tag
Consumers of the NPM package happy-dom
npmhappy-dom
Read check LowCWE-1333
Regular expression denial of service in jquery-validation - jquery-validation
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input...
npmjquery-validation
Read check MediumCWE-1333
CommonRegexJS Regular Expression Denial of Service vulnerability
CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service...
npmcommonregex
Read check MediumCWE-1333
Foundation Regular Expression Denial of Service vulnerability
Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS)....
npmfoundation-sites
Read check MediumCWE-1333
insane vulnerable to Regular Expression Denial of Service
insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service...
npminsane
Read check MediumCWE-22
JSZip contains Path Traversal via loadAsync
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
npmjszip
Read check MediumCWE-754
Insufficient validation when decoding a Socket.IO packet
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
npmsocket.io-parser
Read check HighCWE-798
EverShop at risk to unauthorized access via weak HMAC secret
An issue was discovered in NPM’s package @evershop/evershop before version 1.0.0-rc.9. The HMAC secret used for generating tokens is hardcoded as “secret”.
npm@evershop/evershop
Read check MediumCWE-754
socket.io has an unhandled 'error' event
A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.
npmsocket.io
Read check HighCWE-78
rejetto HFS vulnerable to OS Command Execution by remote authenticated users
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have...
npmhfs
Read check MediumCWE-22
webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle
An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted malicious code on Windows systems. This vulnerability is triggered when using...
npmwebcrack
Read check MediumCWE-79
CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover
The issue impacts only editor instances with enabled version notifications.
npmckeditor4
Read check MediumCWE-94
@blakeembrey/template vulnerable to code injection when attacker controls template input
It is possible to inject and run code within the template if the attacker has access to write the template name.
npm@blakeembrey/template
Read check HighCWE-1321
node-gettext vulnerable to Prototype Pollution
All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improper user input sanitization.
npmnode-gettext
Read check MediumCWE-79
Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server
Firebase JavaScript SDK utilizes a “FIREBASE_DEFAULTS” cookie to store configuration data, including an “_authTokenSyncURL” field used for session synchronization.
npmfirebase
Read check HighCWE-601
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
By combining two vulnerabilities (an Open Redirect and session token sent as URL query parameter) in Strapi framework is its possible of an unauthenticated attacker...
npm@strapi/plugin-users-permissions
Read check MediumCWE-125
Open Chinese Convert subject to Denial of Service via Out-of-bounds Read
Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset...
npmopencc
Read check MediumCWE-79
Cross-site scripting in bootstrap-select
bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in...
npmbootstrap-select
Read check LowCWE-79
@sveltejs/kit has unescaped error message included on error page
The static error.html template for errors contains placeholders that are replaced without escaping the content first.
npm@sveltejs/kit
Read check HighCWE-434
Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal
A vulnerability has been discovered in Agnai that permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution...
npmagnai
Read check LowCWE-35
Agnai File Disclosure Vulnerability: JSON via Path Traversal
https://cwe.mitre.org/data/definitions/35.html
npmagnai
Read check LowCWE-35
Agnai vulnerable to Relative Path Traversal in Image Upload
A vulnerability has been discovered in Agnai that permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to...
npmagnai
Read check MediumCWE-79
Nunjucks autoescape bypass leads to cross site scripting
In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two...
npmnunjucks
Read check HighCWE-918
@lobehub/chat Server Side Request Forgery vulnerability
lobe-chat before 1.19.13 has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak...
npm@lobehub/chat
Read check MediumCWE-79
vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/core-base
XSS
npm@intlify/core-base
Read check MediumCWE-79
vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/core
XSS
npm@intlify/core
Read check MediumCWE-79
vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/vue-i18n-core
XSS
npm@intlify/vue-i18n-core
Read check MediumCWE-79
vue-i18n has cross-site scripting vulnerability with prototype pollution - vue-i18n
XSS
npmvue-i18n
Read check MediumCWE-79
vue-i18n has cross-site scripting vulnerability with prototype pollution
XSS
npmpetite-vue-i18n
Read check MediumCWE-1321
@intlify/shared Prototype Pollution vulnerability - @intlify/shared
Vulnerability type: Prototype Pollution
npm@intlify/shared
Read check MediumCWE-1321
@intlify/shared Prototype Pollution vulnerability - @intlify/vue-i18n-core
Vulnerability type: Prototype Pollution
npm@intlify/vue-i18n-core
Read check MediumCWE-1321
@intlify/shared Prototype Pollution vulnerability - vue-i18n
Vulnerability type: Prototype Pollution
npmvue-i18n
Read check MediumCWE-1321
@intlify/shared Prototype Pollution vulnerability
Vulnerability type: Prototype Pollution
npmpetite-vue-i18n
Read check HighCWE-94
hull.js Code Injection Vulnerability
Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of new Function(...) in the module...
npmhull.js
Read check LowCWE-200
Firepad allows insecure document access
Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content...
npmfirepad
Read check MediumCWE-915
Prototype Pollution in the merge and clone helper methods
Using merge and clone helper methods in the src/core/util.ts module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which...
npmzrender
Read check MediumCWE-79
Trix editor subject to XSS vulnerabilities on copy & paste
The Trix editor, in versions prior to 2.1.9 and 1.3.3, is vulnerable to XSS + mutation XSS attacks when pasting malicious code.
npmtrix
Read check HighCWE-94
Angular Expressions - Remote Code Execution when using locals
An attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system.
npmangular-expressions
Read check MediumCWE-79
Marp Core allows XSS by improper neutralization of HTML sanitization
Marp Core (@marp-team/marp-core) from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization.
npm@marp-team/marp-core
Read check MediumCWE-79
Trix allows Cross-site Scripting via `javascript:` url in a link
The Trix editor, versions prior to 2.1.11, is vulnerable to XSS when pasting malicious code in the link field.
npmtrix
Read check MediumCWE-94
dom-iterator code execution vulnerability
Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function...
npmdom-iterator
Read check HighCWE-915
json-schema is vulnerable to Prototype Pollution
json-schema before version 0.4.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’).
npmjson-schema
Read check MediumCWE-79
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
Authenticated users are able to exploit an XSS vulnerability when viewing certain localized backoffice components.
npm@umbraco-cms/backoffice
Read check LowCWE-79
@sveltejs/kit vulnerable to XSS on dev mode 404 page
“Unsanitized input from the request URL flows into end, where it is used to render an HTML page returned to the user. This may result...
npm@sveltejs/kit
Read check HighCWE-1333
path-to-regexp outputs backtracking regular expressions
A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.)....
npmpath-to-regexp
Read check MediumCWE-79
Cross Site Scripting vulnerability in store2
Cross Site Scripting vulnerability in nbubna store v.2.14.2 and before allows a remote attacker to execute arbitrary code via the store.deep.js component
npmstore2
Read check MediumCWE-200
Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/vite-builder
Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.
npm@nuxt/vite-builder
Read check MediumCWE-749
Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/webpack-builder
Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site.
npm@nuxt/webpack-builder
Read check MediumCWE-749
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site.
npm@nuxt/rspack-builder
Read check LowCWE-774
Potential DoS when using ContextLines integration - @sentry/astro
The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...
npm@sentry/astro
Read check LowCWE-774
Potential DoS when using ContextLines integration - @sentry/bun
The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...
npm@sentry/bun
Read check LowCWE-774
Potential DoS when using ContextLines integration - @sentry/nextjs
The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...
npm@sentry/nextjs
Read check LowCWE-774
Potential DoS when using ContextLines integration - @sentry/nuxt
The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...
npm@sentry/nuxt
Read check LowCWE-774
Potential DoS when using ContextLines integration - @sentry/remix
The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...
npm@sentry/remix
Read check LowCWE-774
Potential DoS when using ContextLines integration - @sentry/solidstart
The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...
npm@sentry/solidstart
Read check LowCWE-774
Potential DoS when using ContextLines integration
The ContextLines integration uses readable streams to more efficiently use memory when reading files. The ContextLines integration is used to attach source context to outgoing...
npm@sentry/sveltekit
Read check HighCWE-94
Remote Code Execution on click of <a> Link in markdown preview
There is a vulnerability in Joplin-desktop that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The...
npmjoplin
Read check MediumCWE-77
files.photo.gallery command injection
A command injection vulnerability in the video thumbnail rendering component of files.photo.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted...
npmfiles.photo.gallery
Read check HighCWE-94
JSONPath Plus Remote Code Execution (RCE) Vulnerability
Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code...
npmjsonpath-plus
Read check HighCWE-79
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc
An unsafe parsing logic of the URL from markdown can lead to arbitrary JavaScript code due to a bypass to the existing guards around the...
npm@nuxtjs/mdc
Read check HighCWE-1321
@ndhoule/defaults prototype pollution
A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
npm@ndhoule/defaults
Read check HighCWE-1321
vxe-table prototype pollution
A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
npmvxe-table
Read check MediumCWE-346
esbuild enables any website to send any requests to the development server and read the response
esbuild allows any websites to send any request to the development server and read the response due to default CORS settings.
npmesbuild
Read check HighCWE-601
Authentication bypass in @sap/approuter
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code, an attacker can steal the session...
npm@sap/approuter
Read check HighCWE-1321
Prototype Pollution in handlebars - handlebars
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
npmhandlebars
Read check HighCWE-74
Prototype Pollution in handlebars
Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects’ __proto__ and...
npmhandlebars
Read check HighCWE-471
dot-prop Prototype Pollution vulnerability
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language...
npmdot-prop
Read check HighCWE-400
axios Inefficient Regular Expression Complexity vulnerability
axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.
npmaxios
Read check MediumCWE-697
Regular Expression Denial of Service in jsoneditor
JSON Editor is a web-based tool to view, edit, format, and validate JSON. It has various modes such as a tree editor, a code editor,...
npmjsoneditor
Read check HighCWE-908
Potential memory exposure in dns-packet
This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets....
npmdns-packet
Read check HighCWE-400
Uncontrolled Resource Consumption in ansi-html
This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long...
npmansi-html
Read check HighCWE-400
Denial of service in css-what
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input....
npmcss-what
Read check HighCWE-502
Deserialization of Untrusted Data in bson
All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object’s _bsontype, leading...
npmbson
Read check HighCWE-1333
parse-duration has a Regex Denial of Service that results in event loop delay and out of memory
This report finds 2 availability issues due to the regex used in the parse-duration npm package: An event loop delay due to the CPU-bound operation...
npmparse-duration
Read check MediumCWE-1333
cookiejar Regular Expression Denial of Service via Cookie.parse function
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function and other aspects of the...
npmcookiejar
Read check HighCWE-1333
http-cache-semantics vulnerable to Regular Expression Denial of Service
http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue...
npmhttp-cache-semantics
Read check MediumCWE-248
engine.io Uncaught Exception vulnerability
A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.
npmengine.io
Read check MediumCWE-1333
word-wrap vulnerable to Regular Expression Denial of Service
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within...
npmword-wrap
Read check HighCWE-347
browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack
An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading...
npmbrowserify-sign
Read check MediumCWE-79
Vega allows Cross-site Scripting via the vlSelectionTuples function - vega-selections
The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.
npmvega-selections
Read check MediumCWE-79
Vega allows Cross-site Scripting via the vlSelectionTuples function
The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.
npmvega
Read check MediumCWE-1333
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrack
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long...
npm@octokit/request-error
Read check HighCWE-639
Insecure Direct Object Reference (IDOR)
IDOR occurs when an application provides direct access to objects based on user input without proper authorization checks. This vulnerability allows attackers to manipulate object...
IDORAuthorizationAccess Control
Read check LowCWE-79
smartbanner.js rel noopener vulnerability
No description available.
npmsmartbanner.js
Read check MediumCWE-79
Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability
The vulnerability has been discovered in Code Snippet GeSHi plugin. All integrators that use GeSHi syntax highlighter on the backend side can be affected.
npmckeditor4
Read check MediumCWE-1333
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Back
For the npm package @octokit/plugin-paginate-rest, when calling octokit.paginate.iterator(), a specially crafted octokit instance—particularly with a malicious link parameter in the headers section of the request—can...
npm@octokit/plugin-paginate-rest
Read check HighCWE-94
JSONPath Plus allows Remote Code Execution
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code...
npmjsonpath-plus
Read check MediumCWE-22
Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler
Missing check vulnerability in the static file handler allows any client to access the files in the server’s file system
npm@graphql-mesh/http
Read check MediumCWE-80
Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package
During a recent internal audit, we identified a Cross-Site Scripting (XSS) vulnerability in the CKEditor 5 real-time collaboration package. This vulnerability can lead to unauthorized...
npm@ckeditor/ckeditor5-real-time-collaboration
Read check HighCWE-732
@tanstack/form-core prototype pollution
A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
npm@tanstack/form-core
Read check HighCWE-1321
@rpldy/uploader prototype pollution
A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
npm@rpldy/uploader
Read check HighCWE-200
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
Private key can be extracted from ECDSA signature upon signing a malformed input (e.g. a string or a number), which could e.g. come from JSON...
npmelliptic
Read check LowCWE-79
tarteaucitron Cross-site Scripting (XSS)
Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(). This is related to SNYK-JS-TARTEAUCITRONJS-8366541
npmtarteaucitronjs
Read check HighCWE-79
Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)
Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments.
npmsolid-js
Read check LowCWE-88
Matrix IRC Bridge allows IRC command injection to own puppeted user
The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can...
npmmatrix-appservice-irc
Read check HighCWE-94
ejson shell parser in MongoDB Compass maybe bypassed
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass’ connection handling....
npm@mongodb-js/connection-form
Read check MediumCWE-401
Cache variables with the operations when transforms exist on the root level even if variables change in the further requ
When you have transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial...
npm@graphql-mesh/runtime
Read check MediumCWE-79
mavo DOM Clobbering vulnerability
A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.
npmmavo
Read check LowCWE-79
seajs Cross-site Scripting vulnerability
Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs package
npmseajs
Read check MediumCWE-759
Manifest Uses a One-Way Hash without a Salt
Manifest employs a weak password hashing implementation that uses SHA3 without a salt. This exposes user passwords to a higher risk of being cracked if...
npmmanifest
Read check MediumCWE-1321
Prototype pollution in json-pointer - json-pointer
This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.
npmjson-pointer
Read check HighCWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` - @intlify/core-base
Vulnerability type:Prototype Pollution
npm@intlify/core-base
Read check HighCWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` - @intlify/core
Vulnerability type:Prototype Pollution
npm@intlify/core
Read check HighCWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` - @intlify/message-resolver
Vulnerability type:Prototype Pollution
npm@intlify/message-resolver
Read check HighCWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` - @intlify/vue-i18n-core
Vulnerability type:Prototype Pollution
npm@intlify/vue-i18n-core
Read check HighCWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson` - vue-i18n
Vulnerability type:Prototype Pollution
npmvue-i18n
Read check HighCWE-1321
Vue I18n Allows Prototype Pollution in `handleFlatJson`
Vulnerability type:Prototype Pollution
npmpetite-vue-i18n
Read check MediumCWE-79
Froala Editor Cross-site Scripting vulnerability
Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.
npmfroala-editor
Read check MediumCWE-79
Froala WYSIWYG editor allows cross-site scripting (XSS)
Inconsistent tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.
npmfroala-editor
Read check MediumCWE-79
JS Html Sanitizer allows XSS when used with contentEditable
XSS vulnerability when the sanitizer is used with a contentEditable element to set the elements innerHTML to a sanitized string produced by the package. If...
npm@jitbit/htmlsanitizer
Read check HighCWE-1321
canvg Prototype Pollution vulnerability
An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement.
npmcanvg
Read check HighCWE-770
jsPDF Bypass Regular Expression Denial of Service (ReDoS)
User control of the first argument of the addImage method results in CPU utilization and denial of service.
npmjspdf
Read check HighCWE-400
@zag-js/core prototype pollution
A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
npm@zag-js/core
Read check HighCWE-400
Open WebUI Uncontrolled Resource Consumption vulnerability
In version v0.3.32 of open-webui/open-webui, the application allows users to submit large payloads in the email and password fields during the sign-in process due to...
npmopen-webui
Read check MediumCWE-79
GetmeUK ContentTools Cross-Site Scripting (XSS)
A vulnerability was found in GetmeUK ContentTools up to 1.6.16. It has been rated as problematic. Affected by this issue is some unknown functionality of...
npmContentTools
Read check LowCWE-1333
@mozilla/readability Denial of Service through Regex
Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.
npm@mozilla/readability
Read check MediumCWE-770
Directus's S3 assets become unavailable after a burst of HEAD requests
There’s some tools that use Directus to sync content and assets.Some of those tools use HEAD method, like Shopify, to check the existence of files.Although,...
npm@directus/storage-driver-s3
Read check MediumCWE-770
Directus's S3 assets become unavailable after a burst of malformed transformations
When making many malformed transformation requests at once, at some point, all assets are being served as 403.
npm@directus/storage-driver-s3
Read check MediumCWE-87
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] - vega
Users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library is used with the vega-interpreter.
npmvega
Read check MediumCWE-87
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library is used with the vega-interpreter.
npmvega-functions
Read check MediumCWE-79
Jellyfin Web Cross-Site Scripting (XSS) via Collection Name
In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the...
npmjellyfin-web
Read check MediumCWE-79
Jellyfin Web Cross-Site Scripting (XSS) via Playlist Name
In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the...
npmjellyfin-web
Read check HighCWE-1321
depath and cool-path vulnerable to Prototype Pollution via `set()` Method - depath
janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers...
npmdepath
Read check HighCWE-1321
depath and cool-path vulnerable to Prototype Pollution via `set()` Method
janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers...
npmcool-path
Read check HighCWE-1321
Redoc Prototype Pollution via `Module.mergeObjects` Component
A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted...
npmredoc
Read check MediumCWE-79
gifplayer XSS vulnerability
XSS vulnerability. All versions under 0.3.7 are impacted
npmgifplayer
Read check HighCWE-444
Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers
We received a report about a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter.
npm@remix-run/express
Read check HighCWE-770
Open WebUI Uncontrolled Resource Consumption vulnerability - open-webui
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a...
npmopen-webui
Read check MediumCWE-79
MathLive's Lack of Escaping of HTML allows for XSS
Despite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the \htmlData command,...
npmmathlive
Read check HighCWE-20
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`
The Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow...
npm@tauri-apps/plugin-shell
Read check LowCWE-79
React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button
All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result in saving the payload in...
npmreact-draft-wysiwyg
Read check HighCWE-120
bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function
Versions of the package bigint-buffer from 0.0.0 to 1.1.5 are vulnerable to Buffer Overflow in the toBigIntLE() function. Attackers can exploit this to crash the...
npmbigint-buffer
Read check MediumCWE-1021
tarteaucitron.js allows UI manipulation via unrestricted CSS injection
A vulnerability was identified in tarteaucitron.js, where user-controlled inputs for element dimensions (width and height) were not properly validated.
npmtarteaucitronjs
Read check MediumCWE-1321
tarteaucitron.js allows prototype pollution via custom text injection
A vulnerability was identified in tarteaucitron.js, where the addOrUpdate function, used for applying custom texts, did not properly validate input.
npmtarteaucitronjs
Read check MediumCWE-79
tarteaucitron.js allows url scheme injection via unfiltered inputs
A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site’s source code or a CMS plugin) to enter a...
npmtarteaucitronjs
Read check MediumCWE-835
ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation
Incorrect number DER encoding can lead to denial on service for absolute values in the range 2**31 – 2**32 - 1. The arithmetic in the...
npm@apeleghq/asn1-der
Read check HighCWE-1321
node-opcua-alarm-condition prototype pollution vulnerability
A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
npmnode-opcua-alarm-condition
Read check HighCWE-89
Flowise Vulnerable to SQL Injection via `tableName` Parameter
Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.
npmflowise-components
Read check MediumCWE-79
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - vega
In vega 5.30.0 and lower, vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not...
npmvega
Read check MediumCWE-79
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter
In vega 5.30.0 and lower, vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not...
npmvega-functions
Read check MediumCWE-79
YUI Cross-site Scripting (XSS) vulnerability - yui - GHSA-x5hj-47vv-53p8
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x...
npmyui
Read check MediumCWE-79
YUI Cross-site Scripting (XSS) vulnerability - yui
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11,...
npmyui
Read check MediumCWE-79
YUI Cross-site Scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11,...
npmyui
Read check HighCWE-918
Server-Side Request Forgery
Server-Side Request Forgery (SSRF) is a vulnerability where an attacker manipulates a server to make unintended requests to internal or external resources. SSRF can be...
SSRFInjectionAccess Control
Read check MediumCWE-79
Cross-site Scripting in jquery-ui
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML...
npmjquery-ui
Read check HighCWE-400
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service
glob-parent 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1.
npmglob-parent
Read check LowCWE-74
cookie accepts cookie name, path, and domain with out of bounds characters
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value)...
npmcookie
Read check MediumCWE-79
jquery-validation vulnerable to Cross-site Scripting
Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder...
npmjquery-validation
Read check HighCWE-400
Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability
A Denial of Service (DoS) vulnerability exists in open-webui/open-webui version 0.3.21. This vulnerability affects multiple endpoints, including /ollama/models/upload, /audio/api/v1/transcriptions, and /rag/api/v1/doc. The application processes multipart...
npmopen-webui
Read check MediumCWE-79
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can...
npm@sveltejs/kit
Read check MediumCWE-1333
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - @babel/helpers
When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some...
npm@babel/helpers
Read check MediumCWE-1333
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups - @babel/runtime
When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some...
npm@babel/runtime
Read check MediumCWE-1333
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
When using Babel to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some...
npm@babel/runtime-corejs3
Read check MediumCWE-79
QMarkdown Cross-Site Scripting (XSS) vulnerability
QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set.
npm@quasar/quasar-ui-qmarkdown
Read check HighCWE-506
Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2
Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. If you are using one of...
npmxrpl
Read check HighCWE-460
tRPC 11 WebSocket DoS Vulnerability
An unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11...
npm@trpc/server
Read check MediumCWE-94
Pug allows JavaScript code execution if an application accepts untrusted input
Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE:...
npmpug
Read check HighCWE-1321
Prototype pollution in 101
Prototype pollution vulnerability in ‘101’ versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution....
npm101
Read check HighCWE-1007
Homograph attack allows Unicode lookalike characters to bypass validation.
Attackers can deceive users into sending funds to an unintended address.
npmbase-x
Read check MediumCWE-200
Information Disclosure via Flags override link - flags
An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted flags ≤3.2.0 and @vercel/flags ≤3.1.1 and in certain circumstances, allowed a bad actor...
npmflags
Read check MediumCWE-200
Information Disclosure via Flags override link
An information disclosure vulnerability affecting Flags SDK has been addressed. It impacted flags ≤3.2.0 and @vercel/flags ≤3.1.1 and in certain circumstances, allowed a bad actor...
npm@vercel/flags
Read check LowCWE-79
Trix vulnerable to Cross-site Scripting on copy & paste
The Trix editor, in versions prior to 2.1.15, is vulnerable to XSS attacks when pasting malicious code.
npmtrix
Read check HighCWE-347
OpenPGP.js's message signature verification can be spoofed
A maliciously modified message can be passed to either openpgp.verify or openpgp.decrypt, causing these functions to return a valid signature verification result while returning data...
npmopenpgp
Read check HighCWE-400
css-what vulnerable to ReDoS due to use of insecure regular expression
The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the re_attr...
npmcss-what
Read check MediumCWE-1321
radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
This is a prototype pollution vulnerability. It impacts users of the set function within the Radashi library.
npmradashi
Read check MediumCWE-1333
Marked allows Regular Expression Denial of Service (ReDoS) attacks
Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used...
npmmarked
Read check LowCWE-338
Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content
Formidable (aka node-formidable) 2.x before 2.1.3 and 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is...
npmformidable
Read check MediumCWE-94
Remote code execution via the `pretty` option.
If a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as...
npmpug
Read check MediumCWE-918
Strapi allows Server-Side Request Forgery in Webhook function
In Strapi latest version, at function Settings -> Webhooks, the application allows us to input a URL in order to create a Webook connection. However,...
npm@strapi/admin
Read check HighCWE-400
Resource exhaustion in engine.io
Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
npmengine.io
Read check HighCWE-1333
path-to-regexp contains a ReDoS
The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296
npmpath-to-regexp
Read check MediumCWE-201
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint
An unauthenticated information disclosure vulnerability exists in the PSU deployment of HAX CMS via the haxPsuUsage API endpoint. This allows any remote unauthenticated user to...
npm@haxtheweb/open-apis
Read check LowCWE-672
Suspended Directus user can continue to use session token to access API
Since the user status is not checked when verifying a session token a suspended user can use the token generated in session auth mode to...
npm@directus/types
Read check HighCWE-185
Regular Expression Denial of Service in papaparse
Versions of papaparse prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The parse function contains a malformed regular expression that takes...
npmpapaparse
Read check MediumCWE-200
Passbolt Browser Extension leaks password information
An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned while a password is being typed, which results...
npmpassbolt-browser-extension
Read check MediumCWE-79
OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer
XSS via .py file containing script tag interpreted as HTML
npm@openlist-frontend/openlist-frontend
Read check HighCWE-20
pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos
This affects both: Unsupported algos (e.g. sha3-256 / sha3-512 / sha512-256) Supported but non-normalized algos (e.g. Sha256 / Sha512 / SHA1 / sha-1 / sha-256...
npmpbkdf2
Read check MediumCWE-94
PrismJS DOM Clobbering vulnerability
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript...
npmprismjs
Read check MediumCWE-94
Stage.js DOM Clobbering vulnerabilty
Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can...
npmstage-js
Read check LowCWE-1333
string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)
string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.
npmstring-math
Read check HighCWE-522
tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled envir
Private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is buffer package
npmtiny-secp256k1
Read check HighCWE-347
tiny-secp256k1 allows for verify() bypass when running in bundled environment
A malicious JSON-stringifyable message can be made passing on verify(), when global Buffer is buffer package
npmtiny-secp256k1
Read check HighCWE-312
react-native-keys insecurely stores encryption cipher and Base64 chunks
react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers...
npmreact-native-keys
Read check MediumCWE-138
tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
A vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML...
npmtarteaucitronjs
Read check HighCWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/astro
Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.
npm@clerk/astro
Read check HighCWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/backend
Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.
npm@clerk/backend
Read check HighCWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/nextjs
Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.
npm@clerk/nextjs
Read check HighCWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/nuxt
Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.
npm@clerk/nuxt
Read check HighCWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/react-router
Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.
npm@clerk/react-router
Read check HighCWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity - @clerk/remix
Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.
npm@clerk/remix
Read check HighCWE-345
@clerk/backend Performs Insufficient Verification of Data Authenticity
Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting improperly signed webhook events.
npm@clerk/tanstack-react-start
Read check HighCWE-306
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated...
npm@modelcontextprotocol/inspector
Read check HighCWE-248
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
Possibility to craft a request that will crash the Qwik Server in the default configuration.
npm@builder.io/qwik-city
Read check HighCWE-200
docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token
No description available.
npmdocusaurus-plugin-content-gists
Read check MediumCWE-79
@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation
The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks.
npm@pdfme/common
Read check HighCWE-311
chromedriver Downloads Resources over HTTP
Affected versions of chromedriver insecurely download resources over HTTP.
npmchromedriver
Read check MediumCWE-525
Better Call routing bug can lead to Cache Deception
Using a CDN that caches (/**/*.png, /**/*.json, /**/*.css, etc…) requests, a cache deception can emerge. This could lead to unauthorized access to user sessions and...
npmbetter-call
Read check MediumCWE-601
DiracX-Web is vulnerable to attack through an Open Redirect on its login page
An attacker can forge a request to redirect an authenticated user to any arbitrary website.
npm@dirac-grid/diracx-web-components
Read check MediumCWE-79
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/core-base
The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution...
npm@intlify/core-base
Read check MediumCWE-79
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/core
The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution...
npm@intlify/core
Read check MediumCWE-79
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/vue-i18n-core
The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution...
npm@intlify/vue-i18n-core
Read check MediumCWE-79
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - vue-i18n
The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution...
npmvue-i18n
Read check MediumCWE-79
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes
The escapeParameterHtml: true option in Vue I18n is designed to protect against HTML/script injection by escaping interpolated parameters. However, this setting fails to prevent execution...
npmpetite-vue-i18n
Read check HighCWE-1321
Prototype pollution in min-dash
The set method is vulnerable to prototype pollution with specially crafted inputs.
npmmin-dash
Read check HighCWE-79
Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering
A remote script-inclusion / stored XSS vulnerability in @nuxtjs/mdc lets a Markdown author inject a <base href="https://attacker.tld"> element.
npm@nuxtjs/mdc
Read check MediumCWE-79
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label
Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio(...
npmjquery-ui
Read check MediumCWE-362
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.
npm@azure/identity
Read check MediumCWE-331
pubnub Insufficient Entropy vulnerability
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package...
npmpubnub
Read check MediumCWE-1321
Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo
Versions of the package bun before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun’s...
npmbun
Read check MediumCWE-79
Angular (deprecated package) Cross-site Scripting
All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of...
npmangular
Read check HighCWE-1321
billboard.js allows prototype pollution via the function generate
billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a...
npmbillboard.js
Read check MediumCWE-798
Sensitive Data Disclosure
Sensitive data disclosure occurs when confidential information such as API tokens, access keys, secrets, or credentials are exposed in publicly accessible content. This can happen...
Information DisclosureSensitive Data ExposureAPI Security
Read check MediumCWE-918
webfinger.js Blind SSRF Vulnerability
The lookup function takes a user address for checking accounts as a feature, however, as perthe ActivityPub spec (https://www.w3.org/TR/activitypub/#security-considerations), on thesecurity considerations section at B.3,...
npmwebfinger.js
Read check HighCWE-77
mcp-package-docs vulnerable to command injection in several tools
A command injection vulnerability exists in the mcp-package-docs MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to...
npmmcp-package-docs
Read check MediumCWE-22
IPX Allows Path Traversal via Prefix Matching Bypass
The approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end...
npmipx
Read check HighCWE-1321
js-toml Prototype Pollution Vulnerability
A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML...
npmjs-toml
Read check MediumCWE-331
The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended
A protocol compliance bug in thinbus-srp-npm versions prior to 2.0.1 causes the client to generate a fixed 252 bits of entropy instead of the intended...
npmthinbus-srp
Read check HighCWE-200
The AuthKit React Router Library rendered sensitive auth data in HTML
In versions before 0.7.0, @workos-inc/authkit-react-router exposed sensitive authentication artifacts — specifically sealedSession and accessToken by returning them from the authkitLoader. This caused them to be...
npm@workos-inc/authkit-react-router
Read check HighCWE-1321
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if you provide a policy name called __proto__ you can override the Object prototype....
npmcontent-security-policy-parser
Read check LowCWE-1022
HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit
When adding a “web link” to the HFS virtual filesystem, the frontend opens it with target="_blank" but without the rel="noopener noreferrer" attribute. This allows the...
npmhfs
Read check HighCWE-400
Prototype Pollution in lodash - lodash
Versions of lodash before 4.17.11 are vulnerable to prototype pollution.
npmlodash
Read check MediumCWE-471
Prototype Pollution in lodash
Versions of lodash before 4.17.5 are vulnerable to prototype pollution.
npmlodash
Read check HighCWE-20
Prototype Pollution in lodash - lodash - GHSA-jf85-cpcp-j695
Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor:...
npmlodash
Read check HighCWE-20
Prototype Pollution in lodash - lodash-amd
Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor:...
npmlodash-amd
Read check HighCWE-20
Prototype Pollution in lodash - lodash.defaultsdeep
Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor:...
npmlodash.defaultsdeep
Read check HighCWE-20
Prototype Pollution in lodash - lodash-es - GHSA-jf85-cpcp-j695
Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor:...
npmlodash-es
Read check HighCWE-770
Prototype Pollution in lodash - lodash - GHSA-p6mc-m468-83gw
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to...
npmlodash
Read check HighCWE-770
Prototype Pollution in lodash - lodash-es
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to...
npmlodash-es
Read check HighCWE-770
Prototype Pollution in lodash - lodash.set
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to...
npmlodash.set
Read check HighCWE-770
Prototype Pollution in lodash - lodash.update
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to...
npmlodash.update
Read check HighCWE-770
Prototype Pollution in lodash - lodash.updatewith
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to...
npmlodash.updatewith
Read check HighCWE-94
Command Injection in lodash - lodash-es
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
npmlodash-es
Read check HighCWE-94
Command Injection in lodash - lodash-template
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
npmlodash-template
Read check HighCWE-94
Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
npmlodash
Read check LowCWE-440
sweetalert2 contains potentially undesirable behavior
sweetalert2 versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality...
npmsweetalert2
Read check HighCWE-1321
Prototype Pollution in jquery-deparam
Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in jquery-deparam allows a malicious user to inject properties into Object.prototype.
npmjquery-deparam
Read check MediumCWE-79
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
In the default configuration of mermaid 11.9.0, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink for...
npmmermaid
Read check High
x402 SDK vulnerable in outdated versions in resource servers for builders - x402
There is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users’ keys, smart contracts, or funds.
npmx402
Read check High
x402 SDK vulnerable in outdated versions in resource servers for builders
There is a security vulnerability in outdated versions of the x402 SDK. This does not directly affect users’ keys, smart contracts, or funds.
npmx402-hono
Read check LowCWE-912
sweetalert2 v10.16.10 and above contains hidden functionality
sweetalert2 versions 10.16.10 and up until 11.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages...
npmsweetalert2
Read check LowCWE-912
sweetalert2 v11.4.9 and above contains hidden functionality
sweetalert2 versions 11.4.9 and above are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do...
npmsweetalert2
Read check MediumCWE-79
Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,...
npmliferay-ckeditor
Read check HighCWE-1321
devalue prototype pollution vulnerability
A string passed to devalue.parse could represent an object with a __proto__ property, which would assign a prototype to an object while allowing properties to...
npmdevalue
Read check MediumCWE-613
Payload does not invalidate JWTs after log out - payload
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token...
npmpayload
Read check MediumCWE-613
Payload does not invalidate JWTs after log out - @payloadcms/next
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token...
npm@payloadcms/next
Read check MediumCWE-613
Payload does not invalidate JWTs after log out
Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token...
npm@payloadcms/graphql
Read check MediumCWE-384
Payload's SQLite adapter Session Fixation vulnerability - payload
A Session Fixation vulnerability existed in Payload’s SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save...
npmpayload
Read check MediumCWE-384
Payload's SQLite adapter Session Fixation vulnerability - @payloadcms/next
A Session Fixation vulnerability existed in Payload’s SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save...
npm@payloadcms/next
Read check MediumCWE-384
Payload's SQLite adapter Session Fixation vulnerability
A Session Fixation vulnerability existed in Payload’s SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save...
npm@payloadcms/graphql
Read check MediumCWE-922
Spoofing attack in swagger-ui
Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could...
npmswagger-ui
Read check HighCWE-674
Denial of Service in jquery
Affected versions of jquery use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, jquery enters...
npmjquery
Read check MediumCWE-185
parse-uri Regular expression Denial of Service (ReDoS) - parse-uri
An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. ## PoC
npmparse-uri
Read check MediumCWE-185
parse-uri Regular expression Denial of Service (ReDoS)
An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. ## PoC
npmparseuri
Read check HighCWE-1333
domain-suffix RegEx Denial of Service
RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function.
npmdomain-suffix
Read check MediumCWE-1333
useragent Regular Expression Denial of Service vulnerability
Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to...
npmuseragent
Read check MediumCWE-79
Mermaid improperly sanitizes sequence diagram labels leading to XSS
In the default configuration of mermaid 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS....
npmmermaid
Read check LowCWE-79
CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - ckeditor5
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading...
npmckeditor5
Read check LowCWE-79
CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package
A Cross-Site Scripting (XSS) vulnerability has been discovered in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading...
npm@ckeditor/ckeditor5-clipboard
Read check HighCWE-918
Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter
When using Astro’s Cloudflare adapter (@astrojs/cloudflare) configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn’t check the URLs...
npm@astrojs/cloudflare
Read check HighCWE-79
Webrecorder packages are vulnerable to XSS through 404 error handling logic - replaywebpage
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL (derived from the original...
npmreplaywebpage
Read check HighCWE-79
Webrecorder packages are vulnerable to XSS through 404 error handling logic - @webrecorder/wabac
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL (derived from the original...
npm@webrecorder/wabac
Read check HighCWE-79
Webrecorder packages are vulnerable to XSS through 404 error handling logic
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter requestURL (derived from the original...
npm@webrecorder/archivewebpage
Read check MediumCWE-79
KaTeX \htmlData does not validate attribute names
KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.
npmkatex
Read check HighCWE-835
jsPDF Denial of Service (DoS)
User control of the first argument of the addImage method results in CPU utilization and denial of service.
npmjspdf
Read check HighCWE-506
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
The DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of duckdb’s...
npm@duckdb/duckdb-wasm
Read check HighCWE-362
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage
Angular uses a DI container (the “platform injector”) to hold request-specific state during server-side rendering. For historical reasons, the container was stored as a JavaScript...
npm@nguniversal/common
Read check HighCWE-506
Prebid.js NPM package briefly compromised
NPM users of prebid 10.9.2. The malicious code attempts to redirect crypto transactions on the site to the attackers’ wallet.
npmprebid.js
Read check HighCWE-506
Prebid-universal-creative latest on npm briefly compromised
Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular...
npmprebid-universal-creative
Read check MediumCWE-79
sanitize-html is vulnerable to XSS through incomprehensive sanitization
sanitize-html prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The sanitizeHtml() function in index.js does not sanitize content when using the custom transformTags...
npmsanitize-html
Read check MediumCWE-506
MetaMask SDK indirectly exposed via malicious [email protected] dependency - @metamask/sdk-react
This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of...
npm@metamask/sdk-react
Read check MediumCWE-506
MetaMask SDK indirectly exposed via malicious [email protected] dependency - @metamask/sdk
This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of...
npm@metamask/sdk
Read check MediumCWE-506
MetaMask SDK indirectly exposed via malicious [email protected] dependency
This advisory only applies to developers who use MetaMask SDK in the browser and who, on Sept 8th 2025 between 13:00–15:30 UTC, performed one of...
npm@metamask/sdk-communication-layer
Read check HighCWE-506
[email protected] contains malware after npm account takeover
On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the...
npmcolor-string
Read check HighCWE-506
[email protected] contains malware after npm account takeover
On 8 September 2025, the npm publishing account for color was taken over after a phishing attack. Version 5.0.1 was published, functionally identical to the...
npmcolor
Read check HighCWE-506
[email protected] contains malware after npm account takeover
On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the...
npmdebug
Read check MediumCWE-79
Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components
Improper Neutralization of Input During Web Page Generation (XSS or ‘Cross-site Scripting’) vulnerability in Bootstrap allows Cross-Site Scripting (XSS). This issue affects Bootstrap version 3.4.1....
npmbootstrap
Read check MediumCWE-79
jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin
Versions of jsondiffpatch prior to 0.7.2 are vulnerable to Cross-site Scripting (XSS) in the HtmlFormatter (HtmlFormatter::nodeBegin). When diffs are rendered to HTML using the built-in...
npmjsondiffpatch
Read check MediumCWE-862
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an...
npmmatrix-js-sdk
Read check HighCWE-77
CodeceptJS's incomprehensive sanitation can lead to Command Injection
CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without...
npmcodeceptjs
Read check MediumCWE-79
Decap CMS Cross Site Scripting (XSS) vulnerability
Decap CMS through 3.8.3 is vulnerable to stored Cross-Site Scripting (XSS) in the admin preview pane. User-controlled fields (e.g., title, description, tags, and body) are...
npmdecap-cms
Read check LowCWE-912
sweetalert2 v9.17.4 and above contains hidden functionality
sweetalert2 versions 9.17.4 and up until 10.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages...
npmsweetalert2
Read check LowCWE-912
sweetalert2 v8.19.1 and above contains hidden functionality
sweetalert2 versions 8.19.1 and up until 9.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages...
npmsweetalert2
Read check HighCWE-506
Malicious versions of Nx were published
Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file system, collects...
npm@nx/key
Read check LowCWE-1321
messageformat has a prototype pollution vulnerability
The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key...
npmmessageformat
Read check MediumCWE-1321
ts-fns has prototype pollution vulnerability
A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided keys in the assign function allows attackers...
npmts-fns
Read check LowCWE-1321
node-cube vulnerable to prototype pollution
The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allow an attacker to inject properties...
npmnode-cube
Read check HighCWE-1321
mpregular vulnerable to prototype pollution
mpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mp.addEventHandler function of mpregular version...
npmmpregular
Read check HighCWE-400
Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity
A security review of the Cattown identified multiple weaknesses that could potentially impact its stability and security.
npmcattown
Read check HighCWE-918
private-ip vulnerable to Server-Side Request Forgery
All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF), where an attacker can provide an IP or hostname that resolves to...
npmprivate-ip
Read check HighCWE-1321
csvjson vulnerable to prototype injection
A Prototype Pollution vulnerability in the toCsv function of csvjson versions thru 5.1.0 allows attackers to inject properties on Object.prototype via supplying a crafted payload,...
npmcsvjson
Read check MediumCWE-1321
json-schema-editor-visual vulnerable to prototype pollution
json-schema-editor-visual is a package that provides jsonschema editor. A Prototype Pollution vulnerability in the setData and deleteData function of json-schema-editor-visual versions thru 1.1.1 allows attackers...
npmjson-schema-editor-visual
Read check HighCWE-1321
dref is vulnerable to prototype pollution
A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
npmdref
Read check MediumCWE-601
lobe-chat has an Open Redirect
npm@lobehub/chat
Read check MediumCWE-79
Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages
We identified a cross-site scripting (XSS) vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine....
npm@lobehub/chat
Read check MediumCWE-1321
counterpart vulnerable to prototype pollution
A vulnerability exists in the counterpart library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected...
npmcounterpart
Read check HighCWE-94
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the...
npm@modelcontextprotocol/inspector
Read check MediumCWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash-amd
lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector...
npmlodash-amd
Read check MediumCWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash-es - GHSA-x5rq-j2xg-h7qm
lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector...
npmlodash-es
Read check MediumCWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash
lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector...
npmlodash
Read check MediumCWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash-es
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
npmlodash-es
Read check MediumCWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash.trim
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
npmlodash.trim
Read check MediumCWE-400
Regular Expression Denial of Service (ReDoS) in lodash - lodash.trimend
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
npmlodash.trimend
Read check MediumCWE-400
Regular Expression Denial of Service (ReDoS) in lodash
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
npmlodash
Read check High
Denial of Service in content
Versions of content are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a...
npmcontent
Read check MediumCWE-1321
algoliasearch-helper is vulnerable to Prototype Pollution in _merge()
Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to...
npmalgoliasearch-helper
Read check HighCWE-770
Finance.js vulnerable to DoS via the seekZero() parameter
An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.
npmfinancejs
Read check LowCWE-79
Fiora chat group avatar is vulnerable to XSS via SVG files
File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files...
npmfiora
Read check HighCWE-754
@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user
When visiting a specific URL, an anonymous user could cause the NodeJS server part of Volto to quit with an error.
npm@plone/volto
Read check HighCWE-95
DocsGPT Allows Remote Code Execution
A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an...
npmdocsgpt
Read check HighCWE-940
SillyTavern Web Interface Vulnerable DNS Rebinding
The web UI for SillyTavern is susceptible to DNS rebinding, allowing attackers to perform actions like install malicious extensions, read chats, inject arbitrary HTML for...
npmsillytavern
Read check HighCWE-834
Finance.js vulnerable to DoS via the IRR function’s depth parameter
Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper handling of the recursion/iteration limit can lead to excessive...
npmfinancejs
Read check HighCWE-770
pdfmake is vulnerable to Throttling via repeatedly redirecting URL in file embedding
Versions of the package pdfmake from 0.3.0-beta.1 to before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in...
npmpdfmake
Read check MediumCWE-287
MCPHub has an Improper Authorization vulnerability via its handleSseConnection function
A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnection of the file src/services/sseService.ts. Such manipulation leads to improper...
npm@samanhappy/mcphub
Read check LowCWE-77
MCPHub's ServerController is vulnerable to Command Injection
A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of...
npm@samanhappy/mcphub
Read check LowCWE-79
Fiora chat user avatar is vulnerable to XSS via SVG files
Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows arbitrary JavaScript execution when malicious SVG files are rendered by other users.
npmfiora
Read check HighCWE-94
Happy DOM: VM Context Escape can lead to Remote Code Execution
No description available.
npmhappy-dom
Read check MediumCWE-79
QGIS QWC2 Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 < 2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.
npmqwc2
Read check MediumCWE-1321
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
Prototype pollution capabilities on various APIs.
npmparse
Read check HighCWE-522
Expo SDK has an OAuth vulnerability
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the “Expo AuthSession Redirect...
npmexpo
Read check HighCWE-1321
`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`
sveltekit-superforms v2.27.3 and prior are susceptible to a prototype pollution vulnerability within the parseFormData function of formData.js. An attacker can inject string and array properties...
npmsveltekit-superforms
Read check HighCWE-400
ReDoS Vulnerability in ua-parser-js version
A regular expression denial of service (ReDoS) vulnerability has been discovered in ua-parser-js.
npmua-parser-js
Read check MediumCWE-22
Mammoth is vulnerable to Directory Traversal
Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth...
npmmammoth
Read check LowCWE-918
Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module
npm@lobehub/chat
Read check LowCWE-1321
rollbar vulnerable to prototype pollution
Prototype pollution potential with the utility function rollbar/src/utility.set(). No impact when using the published public interface.
npmrollbar
Read check MediumCWE-79
Potential XSS vulnerability in jQuery
Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery’s DOM manipulation methods (i.e. .html(), .append(), and...
npmjquery
Read check MediumCWE-613
Strapi is vulnerable to Insufficient Session Expiration
Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen...
npm@strapi/strapi
Read check MediumCWE-1321
rollbar vulnerable to Prototype Pollution in merge()
Prototype pollution vulnerability in merge(). If application code calls rollbar.configure() with untrusted input, prototype pollution is possible.
npmrollbar
Read check HighCWE-347
Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate
Use of curl with the -k (or --insecure) flag in installer scripts allows attackers to deliver arbitrary executables via Man-in-the-Middle (MitM) attacks. This can lead...
npmplaywright
Read check MediumCWE-79
validator.js has a URL validation bypass vulnerability in its isURL function
A URL validation bypass vulnerability exists in validator.js prior to version 13.15.20. The isURL() function uses ‘://’ as a delimiter to parse protocols, while browsers...
npmvalidator
Read check MediumCWE-1321
messageformat prototype pollution vulnerability
The Runtime components of messageformat package for Node.js version 3.0.1 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the...
npm@messageformat/runtime
Read check HighCWE-89
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update
SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.
npmtypeorm
Read check MediumCWE-79
Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes
A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the...
npmbootstrap
Read check HighCWE-20
cipher-base is missing type checks, leading to hash rewind and passing on crafted data
This affects e.g. create-hash (and crypto-browserify), so I’ll describe the issue against that packageAlso affects create-hmac and other packages
npmcipher-base
Read check LowCWE-791
AngularJS improperly sanitizes SVG elements
Improper sanitization of the value of the ‘href’ and ‘xlink:href’ attributes in ‘' SVG elements in AngularJS allows attackers to bypass common image source restrictions....
npmangular
Read check MediumCWE-791
AngularJS Incomplete Filtering of Special Elements vulnerability
Improper sanitization of the value of the ‘href’ and ‘xlink:href’ attributes in ‘' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions....
npmangular-sanitize
Read check HighCWE-20
sha.js is missing type checks leading to hash rewind and passing on crafted data
This is the same as GHSA-cpq7-6gpm-g9rc but just for sha.js, as it has its own implementation.
npmsha.js
Read check MediumCWE-770
angular vulnerable to regular expression denial of service (ReDoS)
AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom...
npmangular
Read check MediumCWE-1333
angular vulnerable to regular expression denial of service via the <input type="url"> element
All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the element due to the usage of an insecure...
npmangular
Read check MediumCWE-1333
angular vulnerable to regular expression denial of service via the $resource service
All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an...
npmangular
Read check MediumCWE-1333
angular vulnerable to regular expression denial of service via the angular.copy() utility
All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of...
npmangular
Read check HighCWE-1333
angular vulnerable to super-linear runtime due to backtracking
This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear...
npmangular
Read check LowCWE-1289
AngularJS allows attackers to bypass common image source restrictions
Improper sanitization of the value of the [srcset] attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a...
npmangular
Read check LowCWE-791
AngularJS allows attackers to bypass common image source restrictions - angular
Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can...
npmangular
Read check MediumCWE-79
ansi_up cross-site scripting vulnerability
The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to...
npmansi_up
Read check HighCWE-94
Arbitrary Code Execution in underscore
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when...
npmunderscore
Read check HighCWE-1321
Prototype Pollution in jquery-bbq
Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.
npmjquery-bbq
Read check MediumCWE-704
Exposure of Sensitive Information to an Unauthorized Actor in nanoid
The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
npmnanoid
Read check HighCWE-27
Path Traversal: 'dir/../../filename' in moment.locale
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
npmmoment
Read check HighCWE-400
Moment.js vulnerable to Inefficient Regular Expression Complexity
No description available.
npmmoment
Read check MediumCWE-1333
Vercel ms Inefficient Regular Expression Complexity vulnerability
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file...
npmms
Read check MediumCWE-74
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies,...
npmpostcss
Read check LowCWE-347
Elliptic's EDDSA missing signature length check
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be...
npmelliptic
Read check LowCWE-130
Elliptic's ECDSA missing check for whether leading bit of r and s is zero
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and...
npmelliptic
Read check LowCWE-347
Elliptic allows BER-encoded signatures
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
npmelliptic
Read check MediumCWE-22
matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to...
npmmatrix-js-sdk
Read check MediumCWE-835
Predictable results in nanoid generation when given non-integer values
When nanoid is called with a fractional value, there were a number of undesirable effects:
npmnanoid
Read check MediumCWE-79
XSS in the `of` option of the `.position()` util in jquery-ui
Accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. For example, invoking the following code:
npmjquery-ui
Read check HighCWE-755
Volto affected by possible DoS by invoking specific URL by anonymous user
When visiting a specific URL, an anonymous user could cause the NodeJS server part of Volto to quit with an error.
npm@plone/volto
Read check LowCWE-1321
min-document vulnerable to prototype pollution
A vulnerability exists in the ‘min-document’ package prior to version 2.19.1, stemming from improper handling of namespace operations in the removeAttributeNS method.
npmmin-document
Read check MediumCWE-79
Nuxt DevTools vulnerable to cross-site scripting (XSS)
A vulnerability in Nuxt DevTools has been fixed in version 2.6.4*. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations....
npm@nuxt/devtools
Read check HighCWE-79
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - vega-expression
Applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if “safe mode” expressionInterpreter is used.
npmvega-expression
Read check HighCWE-79
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia - vega-interpreter
Applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if “safe mode” expressionInterpreter is used.
npmvega-interpreter
Read check HighCWE-79
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global varia
Applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if “safe mode” expressionInterpreter is used.
npmvega
Read check HighCWE-620
Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)
Unverified Email Change - Email as part of Credential / Unverified Account Recovery Channel Change
npmflowise-ui
Read check HighCWE-620
Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change
Bypass of Password Confirmation - Unverified Password Change (authenticated change without current password)
npmflowise-ui
Read check HighCWE-95
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript...
npmopen-webui
Read check HighCWE-22
Flowise is vulnerable to arbitrary file write through its WriteFileTool
The WriteFileTool in Flowise does not restrict the file path for reading, allowing authenticated attackers to exploit this vulnerability to write arbitrary files to any...
npmflowise-components
Read check HighCWE-1321
expr-eval vulnerable to Prototype Pollution - expr-eval
npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary...
npmexpr-eval
Read check HighCWE-1321
expr-eval vulnerable to Prototype Pollution
npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary...
npmexpr-eval-fork
Read check MediumCWE-79
@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message
Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a “welcome message”, which is HTML that is to be rendered on the login...
npm@dependencytrack/frontend
Read check MediumCWE-79
Bootstrap Cross-site Scripting vulnerability - bootstrap - GHSA-pj7m-g53m-7638
In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.
npmbootstrap
Read check HighCWE-915
angular Prototype Pollution vulnerability
Versions of angular prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function merge() does not restrict the modification of an Object’s prototype...
npmangular
Read check MediumCWE-79
Angular vulnerable to Cross-site Scripting
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping <option> elements in <select>...
npmangular
Read check MediumCWE-639
Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage
An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage.
npm@clerk/clerk-js
Read check HighCWE-524
authkit-nextjs may let session cookies be cached in CDNs
In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enabled, this can result in...
npm@workos-inc/authkit-nextjs
Read check HighCWE-323
@hpke/core reuses AEAD nonces
The public SenderContext Seal() API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal() calls. This can...
npm@hpke/core
Read check LowCWE-400
Regular Expression Denial of Service (ReDoS) in braces
A vulnerability was found in Braces versions from v2.2.0 up to but not including v2.3.1. Affected versions of this package are vulnerable to Regular Expression...
npmbraces
Read check HighCWE-1333
Valibot has a ReDoS vulnerability in `EMOJI_REGEX`
The EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100...
npmvalibot
Read check MediumCWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/astro
In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...
npm@sentry/astro
Read check MediumCWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/bun
In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...
npm@sentry/bun
Read check MediumCWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/nextjs
In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...
npm@sentry/nextjs
Read check MediumCWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/node-core
In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...
npm@sentry/node-core
Read check MediumCWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/nuxt
In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...
npm@sentry/nuxt
Read check MediumCWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/remix
In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...
npm@sentry/remix
Read check MediumCWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` - @sentry/solidstart
In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...
npm@sentry/solidstart
Read check MediumCWE-201
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
In version 10.11.0, a change to how the SDK collects request data in Node.js applications caused certain incoming HTTP headers to be added as trace...
npm@sentry/sveltekit
Read check LowCWE-347
Elliptic's verify function omits uniqueness validation
The Elliptic package 6.5.5 for Node.js for EDDSA implementation does not perform the required check if the signature proof(s) is within the bounds of the...
npmelliptic
Read check LowCWE-347
Valid ECDSA signatures erroneously rejected in Elliptic
The Elliptic prior to 6.6.0 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four...
npmelliptic
Read check HighCWE-918
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463
npmaxios
Read check HighCWE-1321
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads.
npmhappy-dom
Read check MediumCWE-1321
parse is vulnerable to prototype pollution
parse is a package designed to parse JavaScript SDK. A Prototype Pollution vulnerability in the SingleInstanceStateController.initializeState function of parse allows attackers to inject properties on...
npmparse
Read check MediumCWE-863
OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation
During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, a user...
npm@oneuptime/common
Read check HighCWE-79
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when ‘Insert Prompt as Rich Text’ is enabled, since the...
npmopen-webui
Read check HighCWE-285
OneUptime Unauthorized User Creation via API
A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.
npm@oneuptime/common
Read check LowCWE-682
Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files
A vulnerability in Vercel’s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists...
npmai
Read check HighCWE-79
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF
A Stored XSS vulnerability has been discovered in Open-WebUI’s Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into...
npmopen-webui
Read check HighCWE-94
expr-eval does not restrict functions passed to the evaluate function - expr-eval
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation,...
npmexpr-eval
Read check HighCWE-94
expr-eval does not restrict functions passed to the evaluate function
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation,...
npmexpr-eval-fork
Read check MediumCWE-321
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
CVE-2025-13877 is an authentication bypass vulnerability caused by insecure default JWT key usage in NocoBase Docker deployments.
npm@nocobase/auth
Read check HighCWE-1321
Elysia vulnerable to prototype pollution with multiple standalone schema validation
Prototype pollution vulnerability in mergeDeep after merging results of two standard schema validations with the same key. Due to the ordering of merging, there must...
npmelysia
Read check HighCWE-94
Elysia affected by arbitrary code injection through cookie config
Arbitrary code execution from cookie config. If dynamic cookies are enabled (ie there exists a schema for cookies), the cookie config is injected into the...
npmelysia
Read check LowCWE-79
@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)
Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links.
npm@tiptap/extension-link
Read check HighCWE-178
Formio improperly authorized permission elevation through specially crafted request path
Summary: A flaw in path handling could allow an attacker to access protected API endpoints by sending a crafted request path. This issue could result...
npmformio
Read check LowCWE-99
EverShop is vulnerable to Unauthorized Order Information Access (IDOR)
A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of the component Order Handler. The manipulation...
npm@evershop/evershop
Read check MediumCWE-327
Altcha Proof-of-Work obfuscation mode cryptanalytic break
A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via...
npmaltcha
Read check MediumCWE-79
Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component
Improper neutralization of the title date in the ‘VDatePicker’ component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a...
npmvuetify
Read check HighCWE-1321
Vuetify has a Prototype Pollution vulnerability
The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal ‘mergeDeep’ utility function used to merge options with defaults.
npmvuetify
Read check HighCWE-1321
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
Note that this vulnerability is only present when using experimental_caller / experimental_nextAppDirCaller.
npm@trpc/server
Read check HighCWE-94
tinacms is vulnerable to arbitrary code execution - tinacms
uses the package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary...
npmtinacms
Read check HighCWE-94
tinacms is vulnerable to arbitrary code execution
uses the package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary...
npm@tinacms/graphql
Read check HighCWE-918
uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)
uppy’s companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.
npm@uppy/companion
Read check HighCWE-1321
plotly.js prototype pollution vulnerability
In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty.
npmplotly.js
Read check HighCWE-352
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass - @apollo/sandbox
A Cross-Site Request Forgery (CSRF) vulnerability was identified in Apollo’s Embedded Sandbox and Embedded Explorer.
npm@apollo/sandbox
Read check HighCWE-352
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass
A Cross-Site Request Forgery (CSRF) vulnerability was identified in Apollo’s Embedded Sandbox and Embedded Explorer.
npm@apollo/explorer
Read check MediumCWE-918
hemmelig allows SSRF Filter bypass via Secret Request functionality
A Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private...
npmhemmelig
Read check MediumCWE-79
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of...
npmvue-template-compiler
Read check MediumCWE-639
axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header
When a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass.
npmaxios-cache-interceptor
Read check HighCWE-1050
evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API
A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server’s resources via the “GET /images” API....
npm@evershop/evershop
Read check MediumCWE-918
evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via...
npm@evershop/evershop
Read check HighCWE-79
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function ga
Applications meeting these two conditions are at risk of arbitrary JavaScript code execution, even if “safe mode” expressionInterpreter is used.
npmvega-selections
Read check HighCWE-79
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function
For sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used...
npmvega-functions
Read check HighCWE-862
misskey.js's export data contains private post data
After adding private posts (followers, direct) that you do not have permission to view to your favorites or clips, you can export them to view...
npmmisskey-js
Read check MediumCWE-307
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header
When using an untrusted reverse proxy or not using a reverse proxy at all, attackers can bypass IP rate limiting by adding a forged X-Forwarded-For...
npmmisskey-js
Read check HighCWE-541
Storybook manager bundle may expose environment variables during build
On December 11th, the Storybook team received a responsible disclosure alerting them to a potential vulnerability in certain built and published Storybooks.
npmstorybook
Read check HighCWE-749
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS...
npm@playwright/mcp
Read check HighCWE-843
Preact has JSON VNode Injection issue
Vulnerability Type: HTML Injection via JSON Type Confusion
npmpreact
Read check MediumCWE-79
Trix has a stored XSS vulnerability through its attachment attribute
The Trix editor, in versions prior to 2.1.16, is vulnerable to XSS attacks through attachment payloads.
npmtrix
Read check LowCWE-1240
Elliptic Uses a Cryptographic Primitive with a Risky Implementation
The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of ‘k’ (as computed based on step 3.2 of RFC 6979...
npmelliptic
Read check HighCWE-79
React Router has XSS Vulnerability
A XSS vulnerability exists in in React Router’s meta()/<Meta> APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR...
npm@remix-run/react
Read check HighCWE-22
React Router has Path Traversal in File Session Storage
If applications use createFileSessionStorage() from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session...
npm@remix-run/deno
Read check HighCWE-79
React Router SSR XSS in ScrollRestoration
A XSS vulnerability exists in in React Router’s <ScrollRestoration> API in Framework Mode when using the getKey/storageKey props during Server-Side Rendering which could allow arbitrary...
npm@remix-run/react
Read check LowCWE-79
Orejime has executable code in HTML attributes
On HTML elements handled by Orejime, one could run malicious code by embedding javascript: code within data attributes.When consenting to the related purpose, Orejime would...
npmorejime
Read check LowCWE-79
QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting
A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results...
npm@questdb/web-console
Read check HighCWE-77
orval MCP client is vulnerable to a code injection attack.
The MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows...
npm@orval/mcp
Read check MediumCWE-1333
tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability
A potential Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter.
npmtarteaucitronjs
Read check MediumCWE-79
jQuery vulnerable to Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via...
npmjquery
Read check HighCWE-94
enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain
A critical sandbox escape vulnerability exists in enclave-vm (affected: < 2.6.0, patched: 2.7.0) that can allow untrusted, sandboxed JavaScript to execute arbitrary code in the...
npmenclave-vm
Read check HighCWE-405
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
Certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted...
npmdevalue
Read check HighCWE-918
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions.
npm@sveltejs/kit
Read check HighCWE-405
Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse
Certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted...
npmdevalue
Read check HighCWE-789
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve
The experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to...
npm@sveltejs/kit
Read check High
Sandbox Breakout / Arbitrary Code Execution in localeval
All versions of localeval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through...
npmlocaleval
Read check HighCWE-770
Axios is vulnerable to DoS attack through lack of data size check
When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes...
npmaxios
Read check MediumCWE-1333
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtrac
The regular expression /<([^>]+)>; rel="deprecation"/ used to match the link header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack....
npm@octokit/request
Read check MediumCWE-918
Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability
Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost...
npmvnu-jar
Read check HighCWE-79
svelte is vulnerable to XSS with textarea bind:value
A server-side rendered <textarea> with two-way bound value does not have its value correctly escaped in the rendered HTML.
npmsvelte
Read check MediumCWE-89
Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM
An SQL injection vulnerability exists in the @veramo/data-store package that allows any authenticated user to execute arbitrary SQL queries against the database. The vulnerability is...
npm@veramo/data-store
Read check HighCWE-73
jsPDF has Local File Inclusion/Path Traversal vulnerability
User control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal.
npmjspdf
Read check High
Unknown vulnerability in Coinbase Wallet SDK
There is a security vulnerability in outdated versions of Coinbase Wallet SDK. This does not directly affect users’ keys, smart contracts, or funds.
npm@coinbase/wallet-sdk
Read check MediumCWE-79
Cross-Site Scripting in backbone
Affected versions of backbone are vulnerable to cross-site scripting when users are allowed to supply input to the Model#Escape function, and the output is then...
npmbackbone
Read check MediumCWE-79
svelte vulnerable to Cross-site Scripting
An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of hydratable keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be...
npmsvelte
Read check LowCWE-284
Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion
knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership.
npm@lobehub/chat
Read check HighCWE-1321
flat vulnerable to Prototype Pollution
flat helps flatten/unflatten nested Javascript objects. A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function...
npmflat
Read check HighCWE-362
@envelop/graphql-modules has a Race Condition vulnerability
Context race condition when using useGraphQLModules plugin
npm@envelop/graphql-modules
Read check HighCWE-79
html2pdf.js contains a cross-site scripting vulnerability
html2pdf.js contains a cross-site scripting (XSS) vulnerability when given a text source rather than an element. This text is not sufficiently sanitized before being attached...
npmhtml2pdf.js
Read check LowCWE-613
Turbo Frame responses can restore stale session cookies
A race condition in Turbo Frames allows delayed HTTP responses to restore stale session cookies after session-modifying operations.
npm@hotwired/turbo
Read check HighCWE-1321
seroval Affected by Prototype Pollution via JSON Deserialization
Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization.This affects only JSON deserialization functionality.
npmseroval
Read check HighCWE-502
seroval Affected by Remote Code Execution via JSON Deserialization
Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution.
npmseroval
Read check HighCWE-770
Seroval affected by Denial of Service via Array serialization
Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time.
npmseroval
Read check HighCWE-770
Seroval affected by Denial of Service via Deeply Nested Objects
Serialization of objects with extreme depth can exceed the maximum call stack limit.
npmseroval
Read check HighCWE-200
Modified package published to npm, containing malware that exfiltrates private key material
Earlier today, a publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish...
npm@solana/web3.js
Read check MediumCWE-400
Prototype Pollution in extend
Versions of extend prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution. The extend() function allows attackers to modify the...
npmextend
Read check HighCWE-506
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches...
npmgot-fetch
Read check HighCWE-20
File restriction bypass in socket.io-file
All versions of socket.io-fileare vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker...
npmsocket.io-file
Read check HighCWE-425
Open Redirect in url-parse
Versions of url-parse before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities....
npmurl-parse
Read check HighCWE-94
Code Injection in node-rules
node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function “fromJSON()” can be controlled by users without any...
npmnode-rules
Read check HighCWE-79
Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE
There is a reflected XSS vulnerability in the GET /admin/edit-codepage/:name route through the name parameter. This can be used to hijack the session of an...
npm@saltcorn/server
Read check MediumCWE-1321
CSVTOJSON has a prototype pollution vulnerability
The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10....
npmcsvtojson
Read check HighCWE-79
billboard.js is vulnerable to XSS during chart option binding
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
npmbillboard.js
Read check MediumCWE-346
elysia-cors Origin Validation Error
An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied...
npm@elysiajs/cors
Read check HighCWE-347
dcap-qvl has Missing Verification for QE Identity
This vulnerability involves a critical gap in the cryptographic verification process within the dcap-qvl.
npm@phala/dcap-qvl
Read check MediumCWE-862
StudioCMS has Authorization Bypass Through User-Controlled Key
StudioCMS contains a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the “Visitor” role to access draft content...
npmstudiocms
Read check MediumCWE-1321
Maker.js has Unsafe Property Copying in makerjs.extendObject
The makerjs.extendObject function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks hasOwnProperty() checks and does not...
npmmakerjs
Read check HighCWE-792
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements
Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that...
npmvalidator
Read check HighCWE-94
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
CVE-2026-23947 had an incomplete fix
npm@orval/core
Read check MediumCWE-73
LobeHub Vulnerable to Improper Authorization in Presigned Upload
The file upload feature in Knowledge Base > File Upload does not validate the integrity of the upload request, allowing users to intercept and modify...
npm@lobehub/chat
Read check HighCWE-78
React2Shell (CVE-2025-66478)
React2Shell is a critical unauthenticated remote code execution vulnerability affecting server-side usage of React Server Components and React Server Functions. The issue arises from a...
ReactNext.jsRCEDeserializationServer ComponentsInjection
Read check HighCWE-918
XML External Entity Injection (XXE)
XML External Entity (XXE) injection occurs when an application parses untrusted XML input with external entity processing enabled. An attacker can define malicious external entities...
XXEXMLInjectionSSRF
Read check HighCWE-22
Flowise is vulnerable to arbitrary file exposure through its ReadFileTool
The ReadFileTool in Flowise does not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read arbitrary files from the file system,...
npmflowise-components
Read check MediumCWE-362
jsPDF has Shared State Race Condition in addJS Plugin
The addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g.,...
npmjspdf
Read check MediumCWE-74
jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)
User control of the first argument of the addMetadata function allows users to inject arbitrary XML.
npmjspdf
Read check HighCWE-770
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
User control of the first argument of the addImage method results in Denial of Service.
npmjspdf
Read check HighCWE-116
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution
User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.
npmjspdf
Read check MediumCWE-639
Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing
An Insecure Direct Object Reference (CWE-639) has been found to exist in createHeaderBasedEmailResolver() function within the Cloudflare Agents SDK.
npmagents
Read check MediumCWE-639
url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.
Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a...
npmurl-parse
Read check MediumCWE-23
Path traversal in url-parse
url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
npmurl-parse
Read check MediumCWE-601
Open redirect in url-parse - url-parse
Affected versions of npm url-parse are vulnerable to URL Redirection to Untrusted Site.
npmurl-parse
Read check MediumCWE-20
Improper Validation and Sanitization in url-parse
Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
npmurl-parse
Read check MediumCWE-79
Qwik SSR XSS via Unsafe Virtual Node Serialization
DescriptionA Cross-site Scripting (CWE-79) vulnerability in Qwik.js’ server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via...
npm@builder.io/qwik-city
Read check HighCWE-1321
Prototype Pollution via FormData Processing in Qwik City
A Prototype Pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create...
npm@builder.io/qwik-city
Read check MediumCWE-352
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using...
npm@builder.io/qwik-city
Read check LowCWE-601
Qwik City Open Redirect via fixTrailingSlash
DescriptionAn Open Redirect (CWE-601) vulnerability in Qwik City’s default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs.
npm@builder.io/qwik-city
Read check HighCWE-1333
@isaacs/brace-expansion has Uncontrolled Resource Consumption
@isaacs/brace-expansion is vulnerable to a Denial of Service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric...
npm@isaacs/brace-expansion
Read check HighCWE-94
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)
A stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be...
npm@lobehub/chat
Read check MediumCWE-674
KaTeX's maxExpand bypassed by `\edef`
KaTeX users who render untrusted mathematical expressions could encounter malicious input using \edef that causes a near-infinite loop, despite setting maxExpand to avoid such loops....
npmkatex
Read check HighCWE-73
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability
The following security vulnerability was identified in jsPDF versions <=3.0.4: Local File Inclusion/Path Traversal.
npmsurvey-pdf
Read check LowCWE-918
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects....
npmwebpack
Read check LowCWE-918
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo...
npmwebpack
Read check MediumCWE-79
SCEditor has DOM XSS via emoticon URL/HTML injection
If an attacker has the ability control configuration options passed to sceditor.create(), like emoticons, charset, etc. then it’s possible for them to trigger an XSS...
npmsceditor
Read check LowCWE-787
Open Chinese Convert has Out-of-bounds Write
A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based...
npmopencc
Read check MediumCWE-835
Sandbox escape via infinite recursion and error objects - @enclave-vm/core
Note: The npm package has moved to @enclave-vm/core (formerly enclave-vm).All fixed versions and guidance refer to @enclave-vm/core.
npm@enclave-vm/core
Read check MediumCWE-835
Sandbox escape via infinite recursion and error objects
Note: The npm package has moved to @enclave-vm/core (formerly enclave-vm).All fixed versions and guidance refer to @enclave-vm/core.
npmenclave-vm
Read check HighCWE-89
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
When querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL Injection attacks. An unauthenticated attacker could extract...
npm@payloadcms/drizzle
Read check MediumCWE-639
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
A cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection.
npmpayload
Read check MediumCWE-918
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
The LangSmith SDK’s distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_url values through the...
npmlangsmith
Read check HighCWE-807
Cube Core is vulnerable to privilege escalation via a specially crafted request
It is possible to make a specially crafted request with a valid API token that leads to privilege escalation.
npm@cubejs-backend/server-core
Read check MediumCWE-755
Cube Core is vulnerable to Denial of Service (DoS) via crafted request
It is possible to make the entire Cube API unavailable by submitting a specially crafted request to a Cube API endpoint.
npm@cubejs-backend/server-core
Read check HighCWE-94
Lightning Flow Scanner Vulnerable to Code Injection via Unsafe Use of `new Function()` in APIVersion Rule
The APIVersion rule uses new Function() to evaluate expression strings. A malicious crafted flow metadata file can cause arbitrary JavaScript execution during scanning. An attacker...
npmlightning-flow-scanner
Read check MediumCWE-352
Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-
A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers.
npm@builder.io/qwik-city
Read check MediumCWE-22
nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()
nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory...
npmnanotar
Read check HighCWE-1321
CASL Ability is Vulnerable to Prototype Pollution
CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability.
npm@casl/ability
Read check HighCWE-89
SQL Injection in typeorm - typeorm
Versions of typeorm before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary...
npmtypeorm
Read check HighCWE-248
fast-xml-parser has RangeError DoS Numeric Entities Bug
A RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., &#9999999; or &#xFFFFFF;). This causes...
npmfast-xml-parser
Read check MediumCWE-918
@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation
The RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended...
npm@langchain/community
Read check HighCWE-1321
set-in Affected by Prototype Pollution
A prototype pollution vulnerability exists in the the npm package set-in (>=2.0.1). Despite a previous fix that attempted to mitigate prototype pollution by checking whether...
npmset-in
Read check MediumCWE-287
cap-go/capacitor-native-biometric Authentication Bypass
There is a potential issue with the cap-go/capacitor-native-biometric library.
npm@capgo/capacitor-native-biometric
Read check MediumCWE-1385
@farmfe/core is Missing Origin Validation in WebSocket
npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting to a WebSocket...
npm@farmfe/core
Read check MediumCWE-1333
markdown-it is has a Regular Expression Denial of Service (ReDoS)
Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the...
npmmarkdown-it
Read check MediumCWE-79
Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler
Summary
npmagents
Read check MediumCWE-79
Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site
A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground’s OAuth callback handler. The error_description query parameter was directly interpolated into an HTML...
npmagents
Read check MediumCWE-79
beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)
beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams.
npmbeautiful-mermaid
Read check MediumCWE-1333
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
By crafting specific options parameters, the endpoint.parse(options) call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang...
npm@octokit/endpoint
Read check HighCWE-20
pbkdf2 silently disregards Uint8Array input, returning static keys
On historic but declared as supported Node.js versions (0.12-2.x), pbkdf2 silently disregards Uint8Array input
npmpbkdf2
Read check MediumCWE-573
BSV Blockchain SDK has an Authentication Signature Data Preparation Vulnerability
No description available.
npm@bsv/sdk
Read check Low
Unauthorized npm publish of [email protected] with modified postinstall script
On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on...
npmcline
Read check HighCWE-94
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method
User control of the argument of the addJS method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload...
npmjspdf
Read check LowCWE-1321
devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed
Under certain circumstances, unevaling untrusted data can produce output code that will create objects with polluted prototypes when later evaled, meaning the output data can...
npmdevalue
Read check LowCWE-770
devalue affected by CPU and memory amplification from sparse arrays
Under certain circumstances, serializing sparse arrays using uneval or stringify could cause CPU and/or memory exhaustion. When this occurs on the server, it results in...
npmdevalue
Read check MediumCWE-770
Memory exhaustion in SvelteKit remote form deserialization (experimental only)
Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to...
npm@sveltejs/kit
Read check MediumCWE-843
CPU exhaustion in SvelteKit remote form deserialization (experimental only)
Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive...
npm@sveltejs/kit
Read check HighCWE-770
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
User control of the first argument of the addImage method results in denial of service.
npmjspdf
Read check HighCWE-79
Fabric.js Affected by Stored XSS via SVG Export
fabric.js applies escapeXml() to text content during SVG export (src/shapes/Text/TextSVGExportMixin.ts:186) but fails to apply it to other user-controlled string values that are interpolated into SVG...
npmfabric
Read check HighCWE-502
LangChain serialization injection vulnerability enables secret extraction - @langchain/core
A serialization injection vulnerability exists in LangChain JS’s toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc'...
npm@langchain/core
Read check HighCWE-502
LangChain serialization injection vulnerability enables secret extraction
A serialization injection vulnerability exists in LangChain JS’s toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc'...
npmlangchain
Read check HighCWE-829
Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde
This is a remote code execution (RCE) vulnerability. Node.js automatically imports **/*.plugin.{js,mjs} files including those from node_modules, so any malicious package with a .plugin.js file...
npm@tygo-van-den-hurk/slyde
Read check MediumCWE-639
Authorization bypass in url-parse
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
npmurl-parse
Read check MediumCWE-639
url-parse Incorrectly parses URLs that include an '@
A specially crafted URL with an ‘@’ sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href....
npmurl-parse
Read check MediumCWE-74
RediSearch Query Injection in @langchain/langgraph-checkpoint-redis
A query injection vulnerability exists in the @langchain/langgraph-checkpoint-redis package’s filter handling. The RedisSaver and ShallowRedisSaver classes construct RediSearch queries by directly interpolating user-provided filter keys...
npm@langchain/langgraph-checkpoint-redis
Read check MediumCWE-79
Svelte affected by XSS in SSR `<option>` element
In certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output....
npmsvelte
Read check MediumCWE-79
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data,...
npmsvelte
Read check MediumCWE-79
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
When using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the...
npmsvelte
Read check MediumCWE-915
Svelte SSR attribute spreading includes inherited properties from prototype chain
In server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object’s prototype chain rather than only own properties. In environments...
npmsvelte
Read check HighCWE-601
Feathers has an open redirect in OAuth callback enables account takeover
The redirect query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to...
npm@feathersjs/authentication-oauth
Read check HighCWE-346
Feathers has an origin validation bypass via prefix matching
The origin validation uses startsWith() for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed...
npm@feathersjs/authentication-oauth
Read check HighCWE-200
Feathers exposes internal headers via unencrypted session cookie
All HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients.
npm@feathersjs/authentication-oauth
Read check HighCWE-1321
Prototype pollution in swiper - swiper
A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by...
npmswiper
Read check MediumCWE-79
Pannellum has a XSS vulnerability in hot spot attributes
The hot spot attributes configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites...
npmpannellum
Read check MediumCWE-835
bn.js affected by an infinite loop
This affects versions of the package bn.js before 4.12.3 and 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and...
npmbn.js
Read check HighCWE-94
OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE
OneUptime lets project members write custom JavaScript that runs inside monitors. The problem is it executes that code using Node.js’s built-in vm module, which Node.js...
npm@oneuptime/common
Read check MediumCWE-918
Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads
A Server-Side Request Forgery (SSRF) vulnerability exists in Payload’s external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects...
npmpayload
Read check MediumCWE-79
repostat: Reflected Cross-Site Scripting (XSS) via repo prop in RepoCard
The RepoCard component is vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability occurs because the component uses React’s dangerouslySetInnerHTML to render the repository name (repo...
npmrepostat
Read check HighCWE-22
Rollup 4 has Arbitrary File Write via Path Traversal
The Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization...
npmrollup
Read check HighCWE-918
Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Angular SSR request handling pipeline.
npm@nguniversal/common
Read check MediumCWE-918
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
A redirect-based Server-Side Request Forgery (SSRF) bypass exists in RecursiveUrlLoader in @langchain/community. The loader validates the initial URL but allows the underlying fetch to follow...
npm@langchain/community
Read check HighCWE-79
Storybook Dev Server is Vulnerable to WebSocket Hijacking
The WebSocket functionality in Storybook’s dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev...
npmstorybook
Read check HighCWE-288
FUXA has JWT Authentication Bypass via HTTP Referer header spoofing
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts...
npm@frangoteam/fuxa
Read check MediumCWE-1321
dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()
dottie versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit 7d3aee1 only validates the first segment of...
npmdottie
Read check MediumCWE-79
Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data
An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a...
npmbootstrap-multiselect
Read check MediumCWE-79
Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
Errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is...
npmsvelte
Read check HighCWE-776
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
The XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the...
npmfast-xml-parser
Read check HighCWE-185
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
No description available.
npmfast-xml-parser
Read check HighCWE-1321
deepHas vulnerable to Prototype Pollution via constructor.prototype
A prototype pollution vulnerability exists in version 1.0.7 of the deephas npm package that allows an attacker to modify global object behavior. This issue was...
npmdeephas
Read check HighCWE-78
OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()
An OS command injection vulnerability in NetworkPathMonitor.performTraceroute() allows any authenticated project user to execute arbitrary operating system commands on the Probe server by injecting shell...
npm@oneuptime/common
Read check HighCWE-94
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
Arbitrary code execution in environments consuming generated clients
npm@orval/core
Read check HighCWE-94
Orval Mock Generation Code Injection via const
I am reporting a code injection vulnerability in Orval’s mock generation pipeline affecting @orval/mock in both the 7.x and 8.x series. This issue is related...
npm@orval/mock
Read check LowCWE-770
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimenta
Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn’t check files.length or individual files’ sizes...
npm@sveltejs/kit
Read check HighCWE-79
CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using...
npmclevertap-web-sdk
Read check HighCWE-79
CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in...
npmclevertap-web-sdk
Read check HighCWE-96
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.
npmserialize-javascript
Read check MediumCWE-400
ajv has ReDoS when using `$data` option
ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern...
npmajv
Read check LowCWE-668
Dark Reader gives users the ability to request style sheets from local web servers
Dark Reader versions prior to 4.9.117 included a behavior where a website could request a style sheet from a locally running web server, for example...
npmdarkreader
Read check HighCWE-294
OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing cre
The WebAuthn authentication implementation does not store the challenge on the server side. Instead, the challenge is returned to the client and accepted back from...
npm@oneuptime/common
Read check MediumCWE-287
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens - workflow
createWebhook() in Vercel Workflow DevKit accepts a user-specified token parameter that serves as the credential for the public webhook endpoint /.well-known/workflow/v1/webhook/{token}.
npmworkflow
Read check MediumCWE-287
Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens
createWebhook() in Vercel Workflow DevKit accepts a user-specified token parameter that serves as the credential for the public webhook endpoint /.well-known/workflow/v1/webhook/{token}.
npm@workflow/core
Read check LowCWE-120
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input
npmfast-xml-parser
Read check LowCWE-22
Backstage vulnerable to potential reading of SCM URLs using built in token
A vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths.
npm@backstage/integration
Read check HighCWE-400
fast-xml-parser vulnerable to Regex Injection via Doctype Entities
“fast-xml-parser” allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching...
npmfast-xml-parser
Read check HighCWE-94
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the...
npm@oneuptime/common
Read check HighCWE-862
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
OneUptime’s GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the...
npm@oneuptime/common
Read check HighCWE-749
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object
Summary
npm@oneuptime/common
Read check HighCWE-862
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex
A low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 by sending a forged is-multi-tenant-query header together with a controlled projectid header.
npm@oneuptime/common
Read check HighCWE-749
OneUptime has Synthetic Monitor RCE via exposed Playwright browser object
OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container.
npm@oneuptime/common
Read check MediumCWE-862
OneUptime has WhatsApp Resend Verification Authorization Bypass
The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the...
npm@oneuptime/common
Read check HighCWE-863
StudioCMS has Privilege Escalation via Insecure API Token Generation
The /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint...
npmstudiocms
Read check HighCWE-287
Feathers has an OAuth Callback Account Takeover issue
An unauthenticated attacker can send a crafted GET request directly to /oauth/:provider/callback with a forged profile in the query string. The OAuth service’s authentication payload...
npm@feathersjs/authentication-oauth
Read check HighCWE-943
Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
Socket.IO clients can send arbitrary JavaScript objects as the id argument to any service method (get, patch, update, remove). The transport layer performs no type...
npm@feathersjs/mongodb
Read check HighCWE-1333
Elysia has a string URL format ReDoS
t.String({ format: 'url' }) is vulnerable to redos
npmelysia
Read check HighCWE-639
StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service
The DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and...
npmstudiocms
Read check MediumCWE-22
@appium/support has a Zip Slip arbitrary file write in its ZIP extraction
@appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of...
npm@appium/support
Read check HighCWE-116
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" pr
User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.
npmjspdf
Read check HighCWE-94
@siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes
| Field | Value ||——-|——-|| Severity | High || CVSS 3.1 | 8.
npm@siteboon/claude-code-ui
Read check HighCWE-78
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection
Download: cve_claudecodeui_submission_v2.zip
npm@siteboon/claude-code-ui
Read check MediumCWE-79
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
The contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted...
npmsvelte
Read check MediumCWE-1321
devalue has prototype pollution in devalue.parse and devalue.unflatten
In devalue v5.6.3, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or...
npmdevalue
Read check HighCWE-22
liquidjs has a path traversal fallback vulnerability
The layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials:...
npmliquidjs
Read check HighCWE-863
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
The S3 storage manager’s isAuthorized() function is declared async (returns Promise<boolean>) but is called without await in both the POST and PUT handlers. Since a...
npm@studiocms/s3-storage
Read check MediumCWE-639
StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation
The POST /studiocms_api/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account....
npmstudiocms
Read check MediumCWE-639
StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings
The updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user’s notification preferences. It checks that the caller...
npmstudiocms
Read check MediumCWE-269
StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts
The REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents...
npmstudiocms
Read check HighCWE-22
Tina: Path Traversal in Media Upload Handle
| Field | Value ||——-|——-|| Package | @tinacms/cli || Version | 2.0.5 (latest at time of discovery) || Vulnerable File | packages/@tinacms/cli/src/next/commands/dev-command/server/media.ts || Vulnerable Lines...
npmtinacms
Read check MediumCWE-22
@tinacms/graphql has a Path Traversal issue
TinaCMS allows users to create, update, and delete content documents using relative file paths (relativePath, newRelativePath) via GraphQL mutations. Under certain conditions, these paths are...
npm@tinacms/graphql
Read check MediumCWE-79
Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check
useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head> tags. This is the composable that Nuxt docs recommend for...
npmunhead
Read check LowCWE-79
Unhead Vulnerable to Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity
The link.href check in makeTagSafe (safe.ts, line 68-71) uses String.includes(), which is case-sensitive:
npmunhead
Read check HighCWE-674
flatted vulnerable to unbounded recursion DoS in parse() revive phase
flatted’s parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential...
npmflatted
Read check LowCWE-1333
es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`
Passing functions with very long names or complex default argument names into function#copy orfunction#toStringTokens may put script to stall
npmes5-ext
Read check HighCWE-330
@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys
User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe. This exposes users to potential loss of...
npm@nfid/embed
Read check LowCWE-80
XSS in @leanprover/unicode-input-component
Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element...
npm@leanprover/unicode-input-component
Read check HighCWE-79
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
The Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allows interactive event bindings in...
npmoneuptime
Read check HighCWE-89
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
The telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as...
npmoneuptime
Read check MediumCWE-532
OneUptime: Password Reset Token Logged at INFO Level
The password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by...
npmoneuptime
Read check MediumCWE-331
crypto-js uses insecure random numbers
The crypto-js package 3.2.0 for Node.js generates random numbers by concatenating the string “0.” with an integer, which makes the output more predictable than necessary....
npmcrypto-js
Read check MediumCWE-400
mapshaper Path Traversal vulnerability
Path Traversal in GitHub repository mbloch/mapshaper prior to 0.6.44.
npmmapshaper
Read check MediumCWE-79
Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas
The Select schema plugin in @pdfme/schemas constructs HTML from template-defined option values using unsanitized string interpolation and sets it via innerHTML, enabling arbitrary JavaScript execution....
npm@pdfme/schemas
Read check MediumCWE-79
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
The SVG schema plugin in @pdfme/schemas renders user-supplied SVG content using container.innerHTML = value without any sanitization, enabling arbitrary JavaScript execution in the user’s browser....
npm@pdfme/schemas
Read check LowCWE-639
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
The REST API getUsers endpoint in StudioCMS uses the attacker-controlled rank query parameter to decide whether owner accounts should be filtered from the result set....
npmstudiocms
Read check MediumCWE-79
NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered...
npm@developer.notchatbot/webchat
Read check HighCWE-306
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
When AUTH_TOKEN and ACCESS_TOKEN environment variables are not set (which is the default out-of-the-box configuration) the /bridge HTTP endpoint is completely unauthenticated.
npmmcp-bridge
Read check HighCWE-918
pdfmake is vulnerable to server-side request forgery (SSRF)
Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix...
npmpdfmake
Read check MediumCWE-79
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - @ckeditor/ckeditor5-html-support
A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading...
npm@ckeditor/ckeditor5-html-support
Read check MediumCWE-79
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package
A Cross-Site Scripting (XSS) vulnerability has been discovered in the General HTML Support feature. This vulnerability could be triggered by inserting specially crafted markup, leading...
npmckeditor5
Read check HighCWE-116
jsPDF has a PDF Object Injection via FreeText color
User control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions.
npmjspdf
Read check HighCWE-770
Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter
The ensureSize() function in @dicebear/converter (versions < 9.4.0) read the width and height attributes from the input SVG to determine the output canvas size for...
npm@dicebear/converter
Read check HighCWE-79
jsPDF has HTML Injection in New Window paths
User control of the options argument of the output function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created...
npmjspdf
Read check HighCWE-843
Qwik City has array method pollution in FormData processing allows type confusion and DoS
Summary
npm@builder.io/qwik-city
Read check MediumCWE-79
PDFME has XSS via Unsanitized i18n Label Injection into innerHTML in multiVariableText propPanel
The multiVariableText property panel in @pdfme/schemas constructs HTML via string concatenation and assigns it to innerHTML using unsanitized i18n label values. An attacker who can...
npm@pdfme/schemas
Read check MediumCWE-918
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
The getB64BasePdf function in @pdfme/common fetches arbitrary URLs via fetch() without any validation when basePdf is a non-data-URI string and window is defined. An attacker...
npm@pdfme/common
Read check MediumCWE-79
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling
Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads...
npmvulnogram
Read check HighCWE-89
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key()...
npmkysely
Read check HighCWE-89
OneUptime ClickHouse vulnerable to SQL Injection via unvalidated column identifiers in sort, select, and groupBy paramet
The fix for GHSA-p5g2-jm85-8g35 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not apply the same...
npmoneuptime
Read check HighCWE-345
OneUptime WhatsApp Webhook Missing Signature Verification
The WhatsApp POST webhook handler (/notification/whatsapp/webhook) processes incoming status update events without verifying the Meta/WhatsApp X-Hub-Signature-256 HMAC signature, allowing any unauthenticated attacker to send forged...
npmoneuptime
Read check HighCWE-754
socket.io allows an unbounded number of binary attachments
A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to...
npmsocket.io-parser
Read check HighCWE-330
agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` - @dfinity/identity
The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which...
npm@dfinity/identity
Read check HighCWE-330
agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`
The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which...
npm@dfinity/auth-client
Read check LowCWE-200
Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin
SDK versions between and including 5.16.0 and 5.19.0 allowed Sentry auth tokens to be set in the optional authToken configuration parameter, for debugging purposes.
npm@sentry/react-native
Read check MediumCWE-1321
Elysia Cookie Value Prototype Pollution
Elysia cookie can be overridden by prototype pollution , eg. __proto__
npmelysia
Read check MediumCWE-538
sanitize-html Information Exposure vulnerability
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration...
npmsanitize-html
Read check MediumCWE-285
PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3` - @powersync/service-core
In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users.
npm@powersync/service-core
Read check MediumCWE-285
PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`
In version 1.20.0, when using new sync streams with config.edition: 3, certain subquery filters were ignored when determining which data to sync to users.
npm@powersync/service-sync-rules
Read check HighCWE-22
`@backstage/backend-common` vulnerable to path traversal through symlinks
Paths checks with the resolveSafeChildPath utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers.
npm@backstage/backend-common
Read check HighCWE-1395
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing
fido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract <= 2.2.0 has a heap buffer over-read in extractStrings() —...
npmfido2-lib
Read check HighCWE-776
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-
The fix for CVE-2026-26278 added entity expansion limits (maxTotalExpansions, maxExpandedLength, maxEntityCount, maxEntitySize) to prevent XML entity expansion Denial of Service. However, these limits are only...
npmfast-xml-parser
Read check HighCWE-347
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey
All versions of the package sjcl are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover...
npmsjcl
Read check HighCWE-362
Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC
No description available.
npmeffect
Read check HighCWE-1321
Prototype Pollution via parse() in NodeJS flatted
Summary
npmflatted
Read check MediumCWE-79
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials - @dicebear/core
SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when...
npm@dicebear/core
Read check MediumCWE-79
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
SVG attribute values derived from user-supplied options (backgroundColor, fontFamily, textColor) were not XML-escaped before interpolation into SVG output. This could allow Cross-Site Scripting (XSS) when...
npm@dicebear/initials
Read check HighCWE-185
SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()
The ensureSize() function in @dicebear/converter used a regex-based approach to rewrite SVG width/height attributes, capping them at 2048px to prevent denial of service. This size...
npm@dicebear/converter
Read check HighCWE-1333
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a...
npmpath-to-regexp
Read check HighCWE-89
Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that
Kysely’s DefaultQueryCompiler.sanitizeStringLiteral() only escapes single quotes by doubling them (' → '') but does not escape backslashes.
npmkysely
Read check HighCWE-89
Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.
The sanitizeStringLiteral method in Kysely’s query compiler escapes single quotes (' → '') but does not escape backslashes. On MySQL with the default BACKSLASH_ESCAPES SQL...
npmkysely
Read check MediumCWE-674
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
Parsing a YAML document with yaml may throw a RangeError due to a stack overflow.
npmyaml
Read check MediumCWE-79
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
resolvePartial() in the Handlebars runtime resolves partial names via a plain property lookup on options.partials without guarding against prototype-chain traversal. When Object.prototype has been polluted...
npmhandlebars
Read check HighCWE-94
Handlebars.js has JavaScript Injection via AST Type Confusion
Handlebars.compile() accepts a pre-parsed AST object in addition to a template string. The value field of a NumberLiteral AST node is emitted directly into the...
npmhandlebars
Read check HighCWE-94
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
The @partial-block special variable is stored in the template data context and is reachable and mutable from within a template via helpers that accept arbitrary...
npmhandlebars
Read check HighCWE-400
path-to-regexp vulnerable to Denial of Service via sequential optional groups
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially...
npmpath-to-regexp
Read check MediumCWE-1333
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires...
npmpath-to-regexp
Read check LowCWE-367
Handlebars.js has a Property Access Validation Bypass in container.lookup
In lib/handlebars/runtime.js, the container.lookup() function uses container.lookupProperty() as a gate check to enforce prototype-access controls, but then discards the validated result and performs a second,...
npmhandlebars
Read check MediumCWE-1321
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
The prototype method blocklist in lib/handlebars/internal/proto-access.js blocks constructor, __defineGetter__, __defineSetter__, and __lookupGetter__, but omits the symmetric __lookupSetter__.
npmhandlebars
Read check HighCWE-201
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies
happy-dom may attach cookies from the current page origin (window.location) instead of the request target URL when fetch(..., { credentials: "include" }) is used. This...
npmhappy-dom
Read check MediumCWE-125
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
OpenCC versions before 1.2.0 contain two CWE-125: Out-of-bounds Read issues caused by length validation failures in UTF-8 processing. When handling malformed or truncated UTF-8 input,...
npmopencc
Read check HighCWE-325
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation.
npmjsrsasign
Read check HighCWE-918
Cloud Metadata Disclosure
Cloud Metadata Disclosure occurs when a server retrieves and discloses sensitive information from cloud metadata services. This typically happens when user-controlled input is used to...
Information DisclosureSSRF
Read check HighCWE-918
Possible Server-Side Request Forgery
A Possible Server-Side Request Forgery (SSRF) vulnerability occurs when a server appears to make outbound requests based on user-supplied input. Indicators such as response delays...
SSRFInjectionAccess Control
Read check HighCWE-400
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
The replace_first filter in LiquidJS uses JavaScript’s String.prototype.replace() which interprets $& as a backreference to the matched substring. The filter only charges memoryLimit for the...
npmliquidjs
Read check HighCWE-400
LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
LiquidJS’s memoryLimit security mechanism can be completely bypassed by using reverse range expressions (e.g., (100000000..1)), allowing an attacker to allocate unlimited memory. Combined with a...
npmliquidjs
Read check LowCWE-369
jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction...
npmjsrsasign
Read check HighCWE-94
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
A code injection vulnerability in ECMAScriptModuleCompiler allows an attacker to achieve Remote Code Execution (RCE) by injecting arbitrary JavaScript expressions inside export { } declarations...
npmhappy-dom
Read check HighCWE-754
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
When a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. ``), the compiled template calls lookupProperty(decorators, "n"), which returns undefined. The runtime then...
npmhandlebars
Read check HighCWE-94
Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
A crafted object placed in the template context can bypass all conditional guards in resolvePartial() and cause invokePartial() to return undefined. The Handlebars runtime then...
npmhandlebars
Read check HighCWE-94
Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
The Handlebars CLI precompiler (bin/handlebars / lib/precompiler.js) concatenates user-controlled strings — template file names and several CLI options — directly into the JavaScript it emits,...
npmhandlebars
Read check HighCWE-913
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
## Summary
npm@nocobase/plugin-workflow-javascript
Read check MediumCWE-918
Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters
Product: Nuxt OG ImageVersion: < 6.2.5CWE-ID: CWE-918: Server-Side Request Forgery
npmnuxt-og-image
Read check MediumCWE-352
Payload has a CSRF Protection Bypass in Authentication Flow
A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to...
npmpayload
Read check MediumCWE-22
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-azure
The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage...
npm@payloadcms/storage-azure
Read check MediumCWE-22
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-gcs
The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage...
npm@payloadcms/storage-gcs
Read check MediumCWE-22
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints - @payloadcms/storage-r2
The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage...
npm@payloadcms/storage-r2
Read check MediumCWE-22
Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage...
npm@payloadcms/storage-s3
Read check MediumCWE-1321
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-amd
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key...
npmlodash-amd
Read check MediumCWE-1321
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key...
npmlodash-es
Read check MediumCWE-1321
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash.unset
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key...
npmlodash.unset
Read check MediumCWE-1321
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key...
npmlodash
Read check HighCWE-94
lodash vulnerable to Code Injection via `_.template` imports key names - lodash-amd
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths...
npmlodash-amd
Read check HighCWE-94
lodash vulnerable to Code Injection via `_.template` imports key names - lodash-es
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths...
npmlodash-es
Read check HighCWE-94
lodash vulnerable to Code Injection via `_.template` imports key names
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths...
npmlodash
Read check HighCWE-508
Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions
A supply chain attack on the axios npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency ([email protected]) that deploys a cross-platform remote access...
npm@lightdash/cli
Read check MediumCWE-404
Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions
Product: Nuxt OG Image Version: 6.1.2CWE-ID: CWE-404: Improper Resource Shutdown or ReleaseDescription: Failure to limit the length and width of the generated image results in...
npmnuxt-og-image
Read check MediumCWE-79
Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes
Product: Nuxt OG Image Version: 6.1.2CWE-ID: CWE-79: Improper Neutralization of Input During Web Page GenerationDescription: Incorrect parsing of GET parameters leads to the possibility of...
npmnuxt-og-image
Read check HighCWE-73
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
A Path Traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating the...
npm@tinacms/graphql
Read check HighCWE-918
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host - @clerk/hono
The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to...
npm@clerk/hono
Read check HighCWE-918
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
The clerkFrontendApiProxy function in @clerk/backend is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to...
npm@clerk/backend
Read check HighCWE-59
@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or Junctions
@tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink...
npm@tinacms/graphql
Read check HighCWE-59
@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or Junctions
@tinacms/graphql uses string-based path containment checks in FilesystemBridge:
npm@tinacms/graphql
Read check HighCWE-89
Payload has an SQL Injection via Query Handling
Certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.
npmpayload
Read check HighCWE-79
@payloadcms/next has Stored XSS in Admin Panel
A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when...
npm@payloadcms/next
Read check HighCWE-918
Payload has Authenticated SSRF via Upload Functionality
An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.
npmpayload
Read check MediumCWE-22
SillyTavern: Path Traversal allows file existence oracle
A path traversal vulnerability in the static file route handler allows any unauthenticated user to determine whether files exist anywhere on the server’s filesystem. By...
npmsillytavern
Read check HighCWE-22
SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user
A Path Traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json...
npmsillytavern
Read check HighCWE-73
SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory
A path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name....
npmsillytavern
Read check MediumCWE-918
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
Distinct from CVE-2025-59159 and CVE-2026-26286 (all fixed in v1.16.0). This endpoint is still unpatched.
npmsillytavern
Read check HighCWE-94
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
A stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization.
npmdbgate-web
Read check LowCWE-77
@elgentos/magento2-dev-mcp vulnerable to command injection
A vulnerability was identified in elgentos magento2-dev-mcp up to 1.0.2. The affected element is the function executeMagerun2Command of the file src/index.ts. Such manipulation leads to...
npm@elgentos/magento2-dev-mcp
Read check HighCWE-674
@stablelib/cbor: Stack exhaustion Denial of Service via deeply nested CBOR arrays, maps, or tags
@stablelib/cbor decodes nested CBOR structures recursively and does not enforce a maximum nesting depth. A sufficiently deep attacker-controlled CBOR payload can therefore crash decoding with...
npm@stablelib/cbor
Read check HighCWE-1321
@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding
@stablelib/cbor decodes CBOR maps into ordinary JavaScript objects and assigns attacker-controlled keys directly onto those objects. A CBOR map key named __proto__ therefore changes the...
npm@stablelib/cbor
Read check MediumCWE-347
StableLib Ed25519 Signature Malleability via Missing S < L Check
No description available.
npm@stablelib/ed25519
Read check HighCWE-352
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
Summary
npmrwsdk
Read check HighCWE-89
Drizzle ORM has SQL injection via improperly escaped SQL identifiers
Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName() implementations. In affected versions, embedded identifier delimiters were not escaped before the identifier was...
npmdrizzle-orm
Read check HighCWE-862
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck
All /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload’s local API with the default overrideAccess: true, bypassing all collection-level access control. The access option...
npm@delmaredigital/payload-puck
Read check High
x402 SDK Security Advisory
A security vulnerability exists in outdated versions of the x402 SDK.
npm@x402/svm
Read check HighCWE-640
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery - payload
A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset....
npmpayload
Read check HighCWE-640
Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery
A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset....
npm@payloadcms/graphql
Read check HighCWE-407
Pretext: Algorithmic Complexity (DoS) in the text analysis phase
isRepeatedSingleCharRun() in src/analysis.ts (line 285) re-scans the entire accumulated segment on every merge iteration during text analysis, producing O(n²) total work for input consisting of...
npm@chenglou/pretext
Read check MediumCWE-1284
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
The DocTypeReader in fast-xml-parser uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits.
npmfast-xml-parser
Read check LowCWE-400
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter
The replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to...
npmliquidjs
Read check MediumCWE-345
LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header
The webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or otherwise authenticated. Because the XOR key is hardcoded in...
npm@lobehub/lobehub
Read check MediumCWE-200
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid
The sort_natural filter bypasses the ownPropertyOnly security option, allowing template authors to extract values of prototype-inherited properties through a sorting side-channel attack. Applications relying on...
npmliquidjs
Read check MediumCWE-22
LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read
liquidjs 10.25.0 documents root as constraining filenames passed to renderFile() and parseFile(), but top-level file loads do not enforce that boundary.
npmliquidjs
Read check MediumCWE-184
Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()
##EVIDENCE
npmunhead
Read check HighCWE-918
Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
Description:Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target...
npmflowise-components
Read check HighCWE-22
Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read
Two unauthenticated path traversal vulnerabilities exist in Saltcorn’s mobile sync endpoints. The POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write...
npm@saltcorn/server
Read check LowCWE-89
@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler
The jsexprToSQL() function in Saltcorn converts JavaScript expressions to SQL for use in database constraints. The Literal handler wraps string values in single quotes without...
npm@saltcorn/data
Read check LowCWE-79
Quill is vulnerable to XSS via HTML export feature
A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).
npmquill
Read check HighCWE-770
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
Under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers...
npm@sveltejs/kit
Read check MediumCWE-755
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service
redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an...
npm@sveltejs/kit
Read check MediumCWE-400
Zod jsVideoUrlParser vulnerable to ReDoS in util.js
A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the function getTime in the library lib/util.js. This manipulation of...
npmjs-video-url-parser
Read check HighCWE-61
LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates
LiquidJS enforces partial and layout root restrictions using the resolved pathname string, but it does not resolve the canonical filesystem path before opening the file....
npmliquidjs
Read check MediumCWE-1321
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set(
Severity: Medium (CVSS ~5.6)Status: Fixed in 0.5.18
npmlangsmith
Read check LowCWE-79
unhead: Streaming SSR `streamKey` injected into inline script without identifier validation
createStreamableHead({ streamKey }) interpolated its streamKey argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application...
npmunhead
Read check LowCWE-79
DbGate has cross site scripting via the SVG Icon String Handler component
A security vulnerability has been detected in DbGate up to 7.1.4. This affects an unknown function of the file packages/web/src/icons/FontIcon.svelte of the component SVG Icon...
npmdbgate-web
Read check MediumCWE-639
MCPHub has an authentication bypass
MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in...
npm@samanhappy/mcphub
Read check MediumCWE-918
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Axios does not correctly handle hostname normalization when checking NO_PROXY rules.Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip...
npmaxios
Read check MediumCWE-79
sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements
Commit 49d0bb7 introduced a regression in sanitize-html that bypasses allowedTags enforcement for text inside nonTextTagsArray elements (textarea and option). Entity-encoded HTML inside these elements passes...
npmsanitize-html
Read check HighCWE-78
Flowise: Authenticated RCE Via MCP Adapters
Due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving...
npmflowise-components
Read check MediumCWE-22
Flowise: Path Traversal in Vector Store basePath
The Faiss and SimpleStore (LlamaIndex) vector store implementations accept a basePath parameter from user-controlled input and pass it directly to filesystem write operations without any...
npmflowise-components
Read check MediumCWE-918
Flowise Execute Flow function has an SSRF vulnerability
The attacker provides an intranet address through the base url field configured in the Execute Flow node → Bypass checkDenyList / resolveAndValidate in httpSecurity.ts (not...
npmflowise-components
Read check MediumCWE-73
Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath
Paperclip contains an arbitrary file read vulnerability that allows an attacker with an Agent API key to read files from the Paperclip server host filesystem.The...
npm@paperclipai/shared
Read check MediumCWE-79
Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization
MarkdownBody, the shared component used to render every Markdown surface in the Paperclip UI (issue documents, issue comments, chat threads, approvals, agent details, export previews,...
npm@paperclipai/ui
Read check MediumCWE-79
Cross-site Scripting (XSS) in serialize-javascript
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript...
npmserialize-javascript
Read check HighCWE-863
@saltcorn/data: Tenant user role is used for tenant creation role check
When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can...
npm@saltcorn/data
Read check MediumCWE-94
Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization
A Prototype Pollution vulnerability was determined in brikcss merge up to 1.3.0. Executing a manipulation of the argument proto/constructor.prototype/prototype can lead to improperly controlled modification...
npm@brikcss/merge
Read check MediumCWE-79
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
No description available.
npmpostcss
Read check HighCWE-943
Flowise: Cypher Injection in GraphCypherQAChain
The GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are...
npmflowise-components
Read check MediumCWE-777
Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
Showdownjs, versions <= 2.1.0, anchors subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious...
npmshowdown
Read check MediumCWE-79
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) - @excalidraw/mermaid-to-excalidraw
@excalidraw/[email protected] depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could...
npm@excalidraw/mermaid-to-excalidraw
Read check MediumCWE-79
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)
@excalidraw/[email protected] depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could...
npm@excalidraw/excalidraw
Read check HighCWE-94
Flowise: Code Injection in CSVAgent leads to Authenticated RCE
The CSVAgent allows providing a custom Pandas CSV read code. Due to lack of sanitization, an attacker can provide the following payload: DataFrame({'foo': ['bar!']});import os;os.system('whoami')...
npmflowise-components
Read check HighCWE-94
Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using `Pandas
No description available.
npmflowise-components
Read check HighCWE-1321
Immutable is vulnerable to Prototype Pollution
A Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs.
npmimmutable
Read check MediumCWE-532
LangSmith SDK: Streaming token events bypass output redaction
The LangSmith SDK’s output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming...
npmlangsmith
Read check HighCWE-77
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
ZDI-CAN-29412: FlowiseAI Flowise Airtable_Agent Code Injection Remote Code Execution Vulnerability
npmflowise-components
Read check HighCWE-20
Flowise: Parameter Override Bypass Remote Command Execution
Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override bypass using the FILE-STORAGE:: keyword...
npmflowise-components
Read check HighCWE-918
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
A Server-Side Request Forgery (SSRF) vulnerability exists in FlowiseAI’s POST/GET API Chain components that allows unauthenticated attackers to force the server to make arbitrary HTTP...
npmflowise-components
Read check HighCWE-918
Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
The core security wrappers (secureAxiosRequest and secureFetch) intended to prevent Server-Side Request Forgery (SSRF) contain multiple logic flaws. These flaws allow attackers to bypass the...
npmflowise-components
Read check HighCWE-91
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - xmldom
@xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without...
npmxmldom
Read check HighCWE-91
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
@xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without...
npm@xmldom/xmldom
Read check HighCWE-863
Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/astro
createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.
npm@clerk/astro
Read check HighCWE-863
Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/nextjs
createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.
npm@clerk/nextjs
Read check HighCWE-863
Official Clerk JavaScript SDKs: Middleware-based route protection bypass - @clerk/shared
createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.
npm@clerk/shared
Read check HighCWE-863
Official Clerk JavaScript SDKs: Middleware-based route protection bypass
createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach downstream handlers.
npm@clerk/nuxt
Read check HighCWE-918
Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
A Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection via HTTP_DENY_LIST for axios and...
npmflowise-components
Read check HighCWE-89
Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)
A critical SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to at least one table to inject arbitrary...
npm@saltcorn/server
Read check HighCWE-184
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
Trend Micro’s Zero Day Initiative has identified a vulnerability affecting FlowiseAI Flowise.
npmflowise-components
Read check LowCWE-918
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)
The fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts (line 28) uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects...
npm@astrojs/cloudflare
Read check MediumCWE-400
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. This...
npmaxios
Read check HighCWE-915
Unsafe object property setter in mathjs
This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can...
npmmathjs
Read check HighCWE-835
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
A critical Denial of Service (DoS) vulnerability exists in [email protected]. By providing a specific 3-byte input sequence a tab, a vertical tab, and a newline...
npmmarked
Read check LowCWE-350
copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action
A vulnerability was determined in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token of the component Header Handler. Executing...
npmcopilot-api
Read check HighCWE-94
Arbitrary code execution in protobufjs
protobufjs could execute generated JavaScript code derived from protobuf schema metadata. When loading a crafted JSON descriptor, schema-controlled type names and type references could reach...
npmprotobufjs
Read check LowCWE-626
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
No description available.
npmaxios
Read check MediumCWE-915
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
No description available.
npmaxios
Read check HighCWE-918
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Ax
1. Executive SummaryThis report documents an incomplete security patch for the previously disclosed vulnerability GHSA-3p68-rc4w-qgx5 (CVE-2025-62718), which affects the NO_PROXY hostname resolution logic in the...
npmaxios
Read check MediumCWE-287
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
No description available.
npmaxios
Read check MediumCWE-201
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
No description available.
npmaxios
Read check HighCWE-1321
Axios: Header Injection via Prototype Pollution
A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability...
npmaxios
Read check HighCWE-1321
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
When Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify...
npmaxios
Read check MediumCWE-770
Axios: HTTP adapter streamed responses bypass maxContentLength
When responseType: ‘stream’ is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.
npmaxios
Read check MediumCWE-770
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when...
npmaxios
Read check MediumCWE-918
Axios: no_proxy bypass via IP alias allows SSRF
The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of...
npmaxios
Read check MediumCWE-93
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
The FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\r\n) sequences. An attacker who controls...
npmaxios
Read check LowCWE-22
auth-js Vulnerable to Insecure Path Routing from Malformed User Input
The library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a...
npm@supabase/auth-js
Read check HighCWE-80
@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Ori
Anonymous GitHub fetches repository content (e.g., markdown files) from GitHub’s API and renders it without sanitization. On the client side, markdown is parsed with marked...
npm@tdurieux/anonymous_github
Read check HighCWE-22
MCPHub has Path Traversal via Malicious MCPB Manifest Name
MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest is directly concatenated into a file...
npm@samanhappy/mcphub
Read check HighCWE-770
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
In simple words, some programs that use _.flatten or _.isEqual could be made to crash. Someone who wants to do harm may be able to...
npmunderscore
Read check LowCWE-1321
mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile:
icu-minify’s runtime formatter resolves select branches by looking up the runtime value as a plain property on a prototype-bearing object. When the value coerces to...
npmicu-minify
Read check MediumCWE-918
BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue
A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/src/http/aiProxyMiddleware.mts of the component...
npm@dadigua/hyperchat
Read check HighCWE-79
CyberChef has a Cross-site Scripting issue
GCHQ CyberChef before 11.0.0 allows XSS via Show Base64 offsets, as demonstrated by the /#recipe=Show_Base64_offsets(‘%3Cscript substring.
npmcyberchef
Read check MediumCWE-79
@diplodoc/search-extension allows stored XSS via Markdown file title
@diplodoc/search-extension 1.0.0 through 3.0.2 allows stored XSS via .md file title.
npm@diplodoc/search-extension
Read check HighCWE-754
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
No description available.
npmaxios
Read check HighCWE-829
Electerm runWidget has a path traversal that leads to arbitrary code execution
The runWidget function in src/app/widgets/load-widget.js constructs a file path by directly concatenating user‑supplied widget identifiers without any sanitisation:
npmelecterm
Read check HighCWE-88
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click
Electerm’s terminal hyperlink handler passes any URL clicked in the terminal directly to shell.openExternal without any protocol validation.
npmelecterm
Read check MediumCWE-312
Electerm's full process.env exposed to renderer via window.pre.env
The getConstants() IPC handler in src/app/lib/ipc-sync.js serialises the entire process.env object and sends it to the renderer. The data is stored as window.pre.env and is...
npmelecterm
Read check HighCWE-88
Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor
A code execution (RCE) vulnerability exists in electerm’s SFTP open with system editor or “Edit with custom editor” feature. When a user opts to edit...
npmelecterm
Read check HighCWE-79
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with...
npm@jupyterlab/help-extension
Read check HighCWE-89
@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading
The queryParentSQL() function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The...
npm@nocobase/database
Read check HighCWE-915
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes
This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can...
npmmathjs
Read check HighCWE-91
xmldom has XML node injection through unvalidated comment serialization - xmldom
The package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment breaking sequences. As a result, an attacker can terminate...
npmxmldom
Read check HighCWE-91
xmldom has XML node injection through unvalidated comment serialization
The package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment breaking sequences. As a result, an attacker can terminate...
npm@xmldom/xmldom
Read check HighCWE-91
xmldom has XML node injection through unvalidated processing instruction serialization - xmldom
The package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker...
npmxmldom
Read check HighCWE-91
xmldom has XML node injection through unvalidated processing instruction serialization
The package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker...
npm@xmldom/xmldom
Read check HighCWE-91
xmldom has XML injection through unvalidated DocumentType serialization - xmldom
The package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatimwithout any escaping or validation. When these fields are set programmatically to attacker-controlledstrings, XMLSerializer.serializeToString can produce...
npmxmldom
Read check HighCWE-91
xmldom has XML injection through unvalidated DocumentType serialization
The package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatimwithout any escaping or validation. When these fields are set programmatically to attacker-controlledstrings, XMLSerializer.serializeToString can produce...
npm@xmldom/xmldom
Read check HighCWE-674
xmldom: Uncontrolled recursion in XML serialization leads to DoS - xmldom
Seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeplynested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the...
npmxmldom
Read check HighCWE-674
xmldom: Uncontrolled recursion in XML serialization leads to DoS
Seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeplynested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the...
npm@xmldom/xmldom
Read check MediumCWE-91
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
No description available.
npmfast-xml-parser
Read check MediumCWE-601
Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward...
npm@saltcorn/server
Read check MediumCWE-74
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
Versions of i18next-http-backend prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation,...
npmi18next-http-backend
Read check MediumCWE-94
i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Versions of i18nextify prior to 4.0.8 substitute `` interpolation tokens inside src and href attribute values with the raw string returned by i18next.t(). The substitution...
npmi18nextify
Read check HighCWE-497
Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods
A vulnerability in the Inngest TypeScript SDK versions 3.22.0 through 3.53.1 allows unauthenticated remote attackers to exfiltrate environment variables from the host process via the...
npminngest
Read check HighCWE-77
electerm: electerm_install_script_CommandInjection Vulnerability Report
Command Injection vulnerabilities in electerm:
npmelecterm
Read check HighCWE-94
OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment
A critical Remote Code Execution (RCE) vulnerability was identified in the OpenLearnX code execution environment, allowing sandbox escape and arbitrary command execution. The issue has...
npmopenlearnx
Read check HighCWE-798
FUXA has a hardcoded fallback JWT signing secret
FUXA used a static fallback JWT signing secret (frangoteam751) when no secretCode was configured.
npm@frangoteam/fuxa
Read check HighCWE-77
electerm has Command Injection via runLinux funtion
Command Injection vulnerabilities in electerm:
npmelecterm
Read check HighCWE-1321
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
Five config properties in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype...
npmaxios
Read check HighCWE-94
protobuf.js: Code injection through bytes field defaults in generated toObject code
protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string...
npmprotobufjs
Read check HighCWE-1321
query-parser-string is vulnerable to Prototype Pollution
NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly...
npmquery-string-parser
Read check HighCWE-400
youtube-regex vulnerable to Regex Denial of Service
Regex Denial of Service in youtube-regex npm package through version 1.0.5.
npmyoutube-regex
Read check HighCWE-22
SillyTavern has a Path Traversal issue
POST /api/extensions/delete endpoint accepts extensionName: "." which bypasses sanitize-filename validation, causing the entire user extensions directory to be recursively deleted. No authentication is required in...
npmsillytavern
Read check MediumCWE-79
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - marko
When dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase...
npmmarko
Read check MediumCWE-79
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
When dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase...
npm@marko/runtime-tags
Read check MediumCWE-74
i18next-locize-backend has URL Injection via Unsanitized Path Parameters
Versions of i18next-locize-backend prior to 9.0.2 interpolate lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath / getLanguagesPath...
npmi18next-locize-backend
Read check HighCWE-79
locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
Versions of the locize client SDK (the browser module that wires up the locize InContext translation editor) prior to 4.0.21 register a window.addEventListener("message", …) handler...
npmlocize
Read check HighCWE-94
Electerm users can run dangrous code through link or command line
No description available.
npmelecterm
Read check MediumCWE-352
RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions
Server actions in rwsdk apply HTTP method enforcement but no origin validation. A request originating from a different origin that the browser treats as same-site...
npmrwsdk
Read check HighCWE-674
liquidjs has a Denial of Service via circular block reference in layout
A circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the...
npmliquidjs
Read check HighCWE-95
Angular Expressions - Remote Code Execution using filters
An attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system.
npmangular-expressions
Read check MediumCWE-918
Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
Flowise introduced SSRF protections through a centralized HTTP security wrapper (httpSecurity.ts) that implements deny-list validation and IP pinning logic.
npmflowise-components
Read check MediumCWE-601
@workos/authkit-session has an Open Redirect via state-derived redirect target
An open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter.
npm@workos/authkit-session
Read check HighCWE-918
link-preview-js vulnerable to IPv6 and internal loopback attacks
The library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal IP....
npmlink-preview-js
Read check HighCWE-754
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled...
npmpdfjs-dist
Read check MediumCWE-79
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution
The vulnerability was automatically discovered by an ai agent and then manually verified.
npm@lobehub/lobehub
Read check HighCWE-918
Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections
The metascraper-logo-favicon plugin makes HTTP requests to URLs extracted from attacker-controlled HTML without going through the application’s validateUrl() SSRF protections. This allows any authenticated user...
npm@karakeep/sdk
Read check MediumCWE-79
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true: you...
npmsvelte
Read check HighCWE-674
protobuf.js: Denial of service through unbounded protobuf recursion
protobufjs could recurse without a depth limit while decoding nested protobuf data. This affected both skipping unknown group fields and generated decoding of nested message...
npmprotobufjs
Read check MediumCWE-176
protobufjs has overlong UTF-8 decoding - @protobufjs/utf8
protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decoder accepted overlong UTF-8 byte sequences and decoded them to...
npm@protobufjs/utf8
Read check MediumCWE-176
protobufjs has overlong UTF-8 decoding
protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decoder accepted overlong UTF-8 byte sequences and decoded them to...
npmprotobufjs
Read check HighCWE-1321
protobuf.js: Process-wide denial of service through unsafe option paths
protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option...
npmprotobufjs
Read check HighCWE-94
protobuf.js: Code generation gadget after prototype pollution
protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted,...
npmprotobufjs
Read check MediumCWE-1321
protobuf.js: Prototype injection in generated message constructors
protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an...
npmprotobufjs
Read check MediumCWE-20
protobuf.js: Denial of service from crafted field names in generated code
protobufjs generated JavaScript property accessors from schema-controlled field and oneof names. Certain control characters in field names were not escaped before being embedded into generated...
npmprotobufjs
Read check MediumCWE-918
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
NocoBase’s workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can...
npm@nocobase/plugin-workflow-request
Read check MediumCWE-22
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - nitro
A proxy route rule like:
npmnitro
Read check MediumCWE-22
Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`
A proxy route rule like:
npmnitropack
Read check HighCWE-290
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Imperson
A critical identity spoofing vulnerability in MCPHub allows any unauthenticated user to impersonate any other user — including administrators — on SSE (Server-Sent Events) and...
npm@samanhappy/mcphub
Read check MediumCWE-863
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks - @backstage/plugin-catalog-unprocessed-entities-common
The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This...
npm@backstage/plugin-catalog-unprocessed-entities-common
Read check MediumCWE-863
Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
The unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This...
npm@backstage/plugin-catalog-unprocessed-entities
Read check MediumCWE-307
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
No description available.
npm@strapi/plugin-users-permissions
Read check LowCWE-613
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions
No description available.
npm@strapi/plugin-users-permissions
Read check LowCWE-613
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
No description available.
npm@strapi/admin
Read check LowCWE-918
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
The isBlockedUrl() denylist introduced in [email protected] to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete.
npmnuxt-og-image
Read check HighCWE-184
Flowise has an MCP Security Bypass that Enables RCE
There are three bypass methods for the security limitations of the Flowise MCP feature, and attackers can execute arbitrary commands by combining these three methods...
npmflowise-components
Read check HighCWE-79
open-webui Vulnerable to Stored XSS via Model Description
[!IMPORTANT] Relationship to CVE-2024-7990
npmopen-webui
Read check HighCWE-862
Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Ex
The tool update endpoint (POST /api/v1/tools/id/{id}/update) is missing the workspace.tools permission check that is present on the tool create endpoint.
npmopen-webui
Read check LowCWE-79
Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML
A stored cross-site scripting (XSS) vulnerability affected entry summary rendering in Sveltia CMS.
npm@sveltia/cms
Read check HighCWE-78
automagik-genie has a command injection vulnerability
Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the view_task (aka view) in the readTranscriptFromCommit function in dist/mcp/server.js...
npmautomagik-genie
Read check HighCWE-1321
@tmlmobilidade/utils has prototype pollution in its setValueAtPath
Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath().
npm@tmlmobilidade/utils
Read check LowCWE-506
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp - @mistralai/mistralai-azure
Mistral npm @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp were compromised by a supply chain attack related to the TanStack security incident. An automated worm associated with the attack...
npm@mistralai/mistralai-azure
Read check LowCWE-506
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp - @mistralai/mistralai
Mistral npm @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp were compromised by a supply chain attack related to the TanStack security incident. An automated worm associated with the attack...
npm@mistralai/mistralai
Read check LowCWE-506
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp
Mistral npm @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp were compromised by a supply chain attack related to the TanStack security incident. An automated worm associated with the attack...
npm@mistralai/mistralai-gcp
Read check MediumCWE-80
Open WebUI Has Stored Cross-Site Scripting in SVG Renderer
There is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation.
npmopen-webui
Read check HighCWE-79
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Banner component due to an improper sanitization order (specifically, DOMPurify is executed before the marked library)....
npmopen-webui
Read check MediumCWE-674
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON().
npmprotobufjs
Read check HighCWE-749
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
The MCP module’s ReplServer binds to all interfaces (0.0.0.0:4403) and exposes a /execute endpoint that runs arbitrary code with zero authentication. Anyone on the network...
npm@penpot/mcp
Read check MediumCWE-918
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
No description available.
npmaxios
Read check HighCWE-1333
seroval affected by Denial of Service via RegExp serialization
Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can...
npmseroval
Read check HighCWE-78
electerm allows unauthorized users to execute arbitrary commands
An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary commands via unverified request to electerms service.
npmelecterm
Read check HighCWE-943
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
No description available.
npm@strapi/strapi
Read check LowCWE-705
@tootallnate/once vulnerable to Incorrect Control Flow Scoping
Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains...
npm@tootallnate/once
Read check MediumCWE-787
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
The v3(), v5(), and v6() API methods (not uuid release versions) accept external output buffers but do not reject out-of-range writes (small buf or large...
npmuuid
Read check MediumCWE-834
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
What kind of vulnerability is it?
npmserialize-javascript
Read check HighCWE-1321
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
The _copyProps function in lib/src/object/copy.ts uses for…in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (proto, constructor,...
npm@nevware21/ts-utils
Read check MediumCWE-79
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS
CryptPad’s HTML sanitizer in Diffmarked.js can be bypassed due to incomplete filtering of restricted tags.Because the sanitizer only validates the src attribute of <iframe> <video>,...
npmcryptpad
Read check HighCWE-94
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
Pre-auth RCE in FUXA via Logic Bypass
npm@frangoteam/fuxa
Read check HighCWE-94
LiquidJS is Vulnerable to Remote Code Execution
It is possible to execute arbitrary code with crafted templates
npmliquidjs
Read check LowCWE-200
@kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment...
npm@kilocode/cli
Read check LowCWE-400
@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue
A vulnerability was determined in Vercel AI up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils....
npm@ai-sdk/provider-utils
Read check HighCWE-89
AgenticMail API/storage and outbound relay hardening fixes
The current upstream main branch at commit 7e0206d was reviewed, and the fix-first patch set was rebased on 2026-05-18.
npm@agenticmail/core
Read check MediumCWE-79
Bootstrap Vulnerable to Cross-Site Scripting - bootstrap
Versions of bootstrap prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The data-template attribute of the tooltip and...
npmbootstrap
Read check MediumCWE-79
Bootstrap Vulnerable to Cross-Site Scripting
Versions of bootstrap prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The data-template attribute of the tooltip and...
npmbootstrap-sass
Read check HighCWE-400
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4). Certain requests can be crafted...
npm@remix-run/server-runtime
Read check HighCWE-770
React Router vulnerable to Denial of Service via reflected user input in single-fetch
A DoS vulnerability exists in the React Router v7 Framework Mode, as well as Remix v2.9.0+ with Single Fetch enabled. In some scenarios the underlying...
npmturbo-stream
Read check HighCWE-94
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
DbGate’s JSON script runner (POST /runners/start) allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value...
npmdbgate-serve
Read check HighCWE-22
DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE
The unzipDirectory() function in packages/api/src/shell/unzipDirectory.js (line 27) does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries...
npmdbgate
Read check HighCWE-78
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
DbGate is vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an...
npmdbgate-api
Read check HighCWE-79
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
TinyMCE 6.8.x contains an XSS vulnerability caused by improper SVG namespace scope handling in the sanitizer. A crafted payload using nested elements can bypass attribute...
npmtinymce
Read check HighCWE-331
Insufficient Entropy in cryptiles
Versions of cryptiles prior to 4.1.2 are vulnerable to Insufficient Entropy. The randomDigits() method does not provide sufficient entropy and its generates digits that are...
npmcryptiles
Read check MediumCWE-674
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError....
npmaxios
Read check LowCWE-79
TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`
telejson versions prior to 6.0.0 (released 2022) are vulnerable to DOM-based Cross-Site Scripting (XSS) through unsafe deserialisation. Attacker-controlled input from the _constructor-name_ property in parsed...
npmtelejson
Read check HighCWE-918
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests...
npmmagicmirror
Read check MediumCWE-79
Bootstrap Cross-site Scripting vulnerability - bootstrap - GHSA-7mvr-5x2g-wfc8
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar...
npmbootstrap
Read check MediumCWE-79
Bootstrap Cross-site Scripting vulnerability - bootstrap-sass
In Bootstrap starting in version 2.3.0 and prior to versions 3.4.0 and 4.1.2, XSS is possible in the data-container property of tooltip. This is similar...
npmbootstrap-sass
Read check MediumCWE-94
Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection
The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures classDef values with...
npmmermaid
Read check MediumCWE-94
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
Under the default configuration, Mermaid state diagram’s classDef allow DOM injection that escapes the SVG, although <script> tags are removed, preventing XSS.
npmmermaid
Read check HighCWE-94
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output code that executes arbitrary code.
npm@babel/plugin-transform-modules-systemjs
Read check HighCWE-1321
Velocity.js has a Prototype Pollution vulnerability through #set path assignment
A prototype pollution vulnerability was discovered in Velocity.js <= 2.1.5. This issue occurs during the processing of #set directives in Velocity templates. If an application...
npmvelocityjs
Read check HighCWE-863
Auth.js SDK has Improper Permission Checking
Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is...
npmauth0-js
Read check HighCWE-20
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker
A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (for example in a DM) can cause...
npmcinny
Read check HighCWE-1321
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)
setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when...
npm@rvf/set-get
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/arktype-adapter
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/arktype-adapter
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/eslint-plugin-router
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/eslint-plugin-router
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/history
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/history
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-router-devtools
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/react-router-devtools
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-router-ssr-query
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/react-router-ssr-query
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-router
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/react-router
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-start-client
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/react-start-client
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-start-rsc
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/react-start-rsc
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/react-start
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/react-start
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-core
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/router-core
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-devtools-core
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/router-devtools-core
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-devtools
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/router-devtools
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-generator
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/router-generator
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-plugin
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/router-plugin
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-ssr-query-core
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/router-ssr-query-core
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-utils
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/router-utils
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/router-vite-plugin
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/router-vite-plugin
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-router-devtools
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/solid-router-devtools
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-router-ssr-query
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/solid-router-ssr-query
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-router
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/solid-router
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-start-client
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/solid-start-client
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/solid-start
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/solid-start
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/start-client-core
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/start-client-core
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/start-storage-context
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/start-storage-context
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/valibot-adapter
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/valibot-adapter
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/virtual-file-routes
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/virtual-file-routes
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-router-devtools
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/vue-router-devtools
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-router-ssr-query
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/vue-router-ssr-query
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-router
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/vue-router
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-start-client
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/vue-start-client
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys - @tanstack/vue-start
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/vue-start
Read check HighCWE-506
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated...
npm@tanstack/zod-adapter
Read check HighCWE-915
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
Kysely 0.28.12 added a sanitizeStringLiteral() call inside DefaultQueryCompiler.visitJSONPathLeg (commit 0a602bf, PR #1727) to fix CVE-2026-32763 (GHSA-wmrf-hv6w-mr66). The fix only doubles single quotes (' → '');...
npmkysely
Read check HighCWE-502
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
The LangSmith SDK’s prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub....
npmlangsmith
Read check MediumCWE-347
OpenLearnX: Critical Authentication Bypass via JWT Signature Verification Disabled Leading to Account Takeover
A critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access to user accounts under specific conditions. The issue has been fixed.
npmopenlearnx
Read check MediumCWE-601
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro
A redirect route rule like:
npmnitro
Read check MediumCWE-601
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
A redirect route rule like:
npmnitropack
Read check HighCWE-94
Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark
No description available.
npmelecterm
Read check MediumCWE-916
electerm's encrypt method not safe enough
No description available.
npmelecterm
Read check HighCWE-1321
@ranfdev/deepobj has a Prototype Pollution vulnerability
Prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must not be exposed as user input.
npm@ranfdev/deepobj
Read check HighCWE-1321
form-data-objectizer: Prototype pollution in form-data-objectizer via bracket-notation form keys
form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects without filtering __proto__, constructor, or prototype. A single HTTP form field whose name starts with...
npmform-data-objectizer
Read check MediumCWE-835
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates.
npmmermaid
Read check MediumCWE-94
Mermaid: Improper sanitization of configuration leads to CSS injection
Mermaid’s default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options.
npmmermaid
Read check MediumCWE-306
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
Neotoma versions starting at v0.6.0 can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token...
npmneotoma
Read check MediumCWE-352
React Router has CSRF issue in Action/Server Action Request Processing
React Router (or Remix v2) is vulnerable to CSRF attacks on document POST requests to UI routes when using server-side route action handlers in Framework...
npm@remix-run/server-runtime
Read check HighCWE-613
SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover
Changing a user’s password does not invalidate existing sessions, allowing an attacker with a stolen cookie to retain access even after the victim resets their...
npmsillytavern
Read check HighCWE-807
SillyTavern has Authentication Bypass via SSO Header Injection
SillyTavern 1.18.0 now includes a configuration option to limit which IP addresses can authorize using SSO headers, limiting to just loopback addresses by default. A...
npmsillytavern
Read check MediumCWE-79
SillyTavern has a reflected XSS vulnerability in the CORS proxy middleware
Fixed in SillyTavern 1.18.0: a user-provided URL is no longer reflected in the HTTP response body.
npmsillytavern
Read check MediumCWE-918
SillyTavern has a SSRF vulnerability in the CORS proxy middleware
SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting).
npmsillytavern
Read check HighCWE-918
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting).
npmsillytavern
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/astro
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/astro
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/backend
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/backend
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/chrome-extension
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/chrome-extension
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/clerk-expo
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/clerk-expo
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/clerk-js
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/clerk-js
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/clerk-react
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/clerk-react
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/expo
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/expo
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/hono
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/hono
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/nextjs
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/nextjs
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/nuxt
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/nuxt
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/react-router
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/react-router
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/react
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/react
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/shared
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/shared
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks - @clerk/vue
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/vue
Read check HighCWE-863
Clerk has an authorization bypass when combining organization, billing, or reverification checks
has(), auth.protect(), and related authorization predicates in @clerk/shared, @clerk/nextjs, @clerk/backend, and other framework SDKs can return true for certain combined authorization checks when the result...
npm@clerk/tanstack-react-start
Read check HighCWE-306
Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
The kanban npm package (used by the cline CLI) starts a WebSocket server on 127.0.0.1:3484 with no Origin header validation. Any website a developer visits...
npmcline
Read check MediumCWE-1321
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-amd
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash...
npmlodash-amd
Read check MediumCWE-1321
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-es
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash...
npmlodash-es
Read check MediumCWE-1321
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash.unset
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash...
npmlodash.unset
Read check MediumCWE-1321
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash...
npmlodash
Read check HighCWE-770
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution
@fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection.
npm@fedify/vocab-runtime
Read check HighCWE-918
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
Multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled...
npm@haxtheweb/open-apis
Read check MediumCWE-79
HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of the <video-player> component.
npm@haxtheweb/video-player
Read check HighCWE-79
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player
A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of <iframe> elements.
npm@haxtheweb/video-player
Read check HighCWE-79
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover
A stored cross-site scripting (XSS) vulnerability exists in HAX CMS due to improper sanitization of <iframe> elements.
npm@haxtheweb/iframe-loader
Read check MediumCWE-1333
Svelte: ReDoS in `<svelte:element>` Tag Validation
An internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. You are only vulnerable to this if you allow...
npmsvelte
Read check HighCWE-770
Svelte devalue: DoS via sparse array deserialization
devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to...
npmdevalue
Read check MediumCWE-79
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.
npmsvelte
Read check MediumCWE-79
Svelte SSR vulnerable to cross-site scripting via spread attributes
When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled...
npmsvelte
Read check HighCWE-87
md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)
A cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including
npmmd-fileserver
Read check LowCWE-918
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
Papra’s webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal...
npm@papra/webhooks
Read check HighCWE-400
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name...
npmaxios
Read check HighCWE-200
Element Call reports full URLs of visited pages to analytics server
Element Call versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a posthog key in config.json or by the...
npm@element-hq/element-call-embedded
Read check HighCWE-94
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts
The OpenZeppelin Contracts Wizard generated Hardhat (test/test.ts) and Foundry (test/<Name>.t.sol) example test files that interpolated user-supplied strings (opts.name, opts.uri) into the test source without escaping....
npm@openzeppelin/wizard
Read check MediumCWE-79
@cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode
Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize...
npm@cyntler/react-doc-viewer
Read check HighCWE-1321
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
js-cookie’s internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object’s "__proto__" member is...
npmjs-cookie
Read check MediumCWE-79
Cross-site scripting in Survey Creator
Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title...
npmsurvey-creator
Read check Medium
wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function
There is a cross-site scripting (XSS) issue in wangEditor via the image upload function in version 4.7.11. This issue has been fixed in version 4.7.12....
npm@wangeditor/editor
Read check MediumCWE-943
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
A NoSQL injection vulnerability existed in MongoDBSaver where checkpoint identifier fields from config.configurable were used in MongoDB queries without strict type enforcement.
npm@langchain/langgraph-checkpoint-mongodb
Read check HighCWE-200
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios...
npmaxios
Read check HighCWE-201
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows.
npmaxios
Read check HighCWE-770
Allocation of Resources Without Limits or Throttling in Axios
Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter.
npmaxios
Read check LowCWE-1321
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
No description available.
npmaxios
Read check MediumCWE-1321
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
axios 1.15.2 exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios...
npmaxios
Read check HighCWE-441
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
No description available.
npmaxios
Read check HighCWE-94
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios versions before the fixed releases contain prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse,...
npmaxios
Read check MediumCWE-400
joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.
npmjoi
Read check LowCWE-22
esbuild allows arbitrary file read when running the development server on Windows
The development server contains a path traversal vulnerability on Windows when serving files from servedir.
npmesbuild
Read check HighCWE-20
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser
The iOS implementation of cordova-plugin-inappbrowser passes the id field from a WKScriptMessage body to commandDelegate sendPluginResult:callbackId: with no format validation (CDVWKInAppBrowser.m:560–574).
npmcordova-plugin-inappbrowser
Read check MediumCWE-94
actual Allows Electron to Run As Node
A electron run as node vulnerability was identified in actual (macOS application, version 25.x (Electron 39.2.7)).
npmactual
Read check HighCWE-79
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Under the default configuration, sanitize-html can turn attacker-controlled content inside a disallowed xmp element into live HTML or JavaScript. This is a sanitizer bypass in...
npmsanitize-html
Read check LowCWE-352
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests.
npm@remix-run/server-runtime
Read check MediumCWE-400
UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
A regular expression denial-of-service (ReDoS) vulnerability has been discovered in ua-parser-js when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an...
npmua-parser-js
Read check MediumCWE-770
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and...
npm@opentelemetry/core
Read check MediumCWE-407
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
A quadratic time complexity vulnerability exists in markdown-it’s smartquotes rule (enabled via the typographer: true option). An attacker can craft a markdown input consisting of...
npmmarkdown-it
Read check MediumCWE-749
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - @nuxt/webpack-builder
This is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev...
npm@nuxt/webpack-builder
Read check MediumCWE-749
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re
This is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev...
npm@nuxt/rspack-builder
Read check MediumCWE-87
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx
TinaCMS rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs —...
npm@tinacms/mdx
Read check MediumCWE-87
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes
TinaCMS rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs —...
npmtinacms
Read check HighCWE-79
Privilege Escalation in cordova-plugin-inappbrowser
Versions of cordova-plugin-inappbrowser prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in...
npmcordova-plugin-inappbrowser
Read check LowCWE-94
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated s - @openzeppelin/wizard-cairo
The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line...
npm@openzeppelin/wizard-cairo
Read check LowCWE-94
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated s - @openzeppelin/wizard-stellar
The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line...
npm@openzeppelin/wizard-stellar
Read check LowCWE-94
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated s - @openzeppelin/wizard-stylus
The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line...
npm@openzeppelin/wizard-stylus
Read check LowCWE-94
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated s
The Contracts Wizard generators printed info.securityContact and info.license verbatim into a single-line comment of the generated Solidity, Cairo, Stellar/Soroban, and Stylus source without rejecting line...
npm@openzeppelin/wizard
Read check MediumCWE-89
TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)
Blind SQL injection vulnerability in UpdateQueryBuilder and SoftDeleteQueryBuilder affecting MySQL and MariaDB users.
npmtypeorm
Read check MediumCWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-chat-ui
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...
npm@theia/ai-chat-ui
Read check MediumCWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-chat
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...
npm@theia/ai-chat
Read check MediumCWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-claude-code
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...
npm@theia/ai-claude-code
Read check MediumCWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-code-completion
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...
npm@theia/ai-code-completion
Read check MediumCWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-core
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...
npm@theia/ai-core
Read check MediumCWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-ide
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...
npm@theia/ai-ide
Read check MediumCWE-201
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without...
npm@theia/ai-editor
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-chat-ui
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...
npm@theia/ai-chat-ui
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-chat
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...
npm@theia/ai-chat
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-claude-code
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...
npm@theia/ai-claude-code
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-code-completion
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...
npm@theia/ai-code-completion
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-core
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...
npm@theia/ai-core
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-ide
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...
npm@theia/ai-ide
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing...
npm@theia/ai-editor
Read check HighCWE-829
[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions - @theia/debug
In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker...
npm@theia/debug
Read check HighCWE-829
[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions - @theia/task
In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker...
npm@theia/task
Read check HighCWE-829
[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions
In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker...
npm@theia/workspace
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-chat-ui
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...
npm@theia/ai-chat-ui
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-chat
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...
npm@theia/ai-chat
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-claude-code
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...
npm@theia/ai-claude-code
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-code-completion
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...
npm@theia/ai-code-completion
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-core
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...
npm@theia/ai-core
Read check HighCWE-829
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI...
npm@theia/ai-editor
Read check HighCWE-940
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover - @tinacms/app
TinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on...
npm@tinacms/app
Read check HighCWE-940
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
TinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on...
npmtinacms
Read check MediumCWE-248
ts-deepmerge: Prototype Method Override leads to DoS
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf)....
npmts-deepmerge
Read check LowCWE-79
Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe
A stored cross-site scripting (XSS) vulnerability affected the Markdown/RichText field preview renderer in Sveltia CMS.
npm@sveltia/cms
Read check HighCWE-352
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
Uni-CLI versions before 0.225.2 exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could...
npm@zenalexa/unicli
Read check HighCWE-1321
scimPatch vulnerable to prototype pollution via unfiltered keys in patch
scim-patch performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "__proto__.someProp". After one such patch,Object.prototype.someProp is set process-wide,...
npmscim-patch
Read check MediumCWE-79
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted
The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion...
npmdevbridge-autocomplete
Read check LowCWE-201
neotoma has tenant isolation gap in relationship query endpoints
The /list_relationships and /retrieve_graph_neighborhood endpoints call getAuthenticatedUserId (confirming a valid session exists) but do not pass the resolved user ID into the Supabase query as...
npmneotoma
Read check HighCWE-1321
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)
Prototype Pollution in internal assign() helper in Linkify allows remote attackers to execute arbitrary JavaScript (Stored or Reflected XSS) via injection of event handlers through...
npmlinkifyjs
Read check MediumCWE-36
MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827
MJML before 5.0.0-alpha.9 allows mj-include directory traversal to test file existence and (in the type=”css” case) read files. NOTE: this issue exists because of an...
npmmjml
Read check LowCWE-1321
Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties
In some circumstances, devalue.parse and devalue.unflatten could emit objects with __proto__ own properties. This in and of itself is not a security vulnerability (and is...
npmdevalue
Read check HighCWE-1333
LinkifyIt#match scan loop has quadratic algorithmic complexity
LinkifyIt.prototype.match — the package’s primary public API — has O(N²) algorithmic complexity for inputs containing many fuzzy links or emails. This is not a regex...
npmlinkify-it
Read check HighCWE-22
better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server
A directory traversal vulnerability exists in the production static file server of better-helperjs (<= 3.0.5). Attackers can read arbitrary files located in adjacent directory structures...
npmbetter-helperjs
Read check HighCWE-862
Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication
No description available.
npmline-desktop-mcp
Read check HighCWE-407
js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
js-toml versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written parseBigInt loop that multiplies a BigInt accumulator...
npmjs-toml
Read check MediumCWE-200
@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub
@microsoft/kiota-http-fetchlibrary’s RedirectHandler is documented as stripping Authorization and Cookie from cross-origin redirect targets, but the default scrubSensitiveHeaders callback in RedirectHandlerOptions uses case-sensitive property deletion (delete...
npm@microsoft/kiota-http-fetchlibrary
Read check HighCWE-79
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via crafted data-mce-* attributes, which are executed when content is rendered. Impacts users...
npmtinymce
Read check MediumCWE-200
@sveltejs/kit: `query.batch` cross-talk
query.batch() could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data...
npm@sveltejs/kit
Read check MediumCWE-918
@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization
The network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows private network...
npm@jshookmcp/jshook
Read check HighCWE-79
wetty vulnerable to DOM XSS via file-download filename
The wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (escapeMarkup: false). Any output...
npmwetty
Read check HighCWE-347
sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced
The documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked.
npmsigstore
Read check HighCWE-918
@asymmetric-effort/specifyjs: URL parse failure silently allows request
Location: core/src/shared/secure-fetch.ts:42-45
npm@asymmetric-effort/specifyjs
Read check MediumCWE-943
@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection
Location: core/src/client/graphql.ts:66-80
npm@asymmetric-effort/specifyjs
Read check MediumCWE-209
@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state
Location: core/src/core/scheduler.ts:23, core/src/hooks/dispatcher.ts:100, core/src/client/graphql.ts:71
npm@asymmetric-effort/specifyjs
Read check MediumCWE-918
@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)
Location: core/src/shared/secure-fetch.ts:52-54
npm@asymmetric-effort/specifyjs
Read check MediumCWE-918
@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction
Location: core/src/shared/secure-fetch.ts:33-35
npm@asymmetric-effort/specifyjs
Read check MediumCWE-918
@asymmetric-effort/specifyjs: No redirect target validation in secureFetch
Location: core/src/shared/secure-fetch.ts
npm@asymmetric-effort/specifyjs
Read check MediumCWE-79
@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString
Location: core/src/server/render-to-string.ts:307-311
npm@asymmetric-effort/specifyjs
Read check HighCWE-407
@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields
A CPU exhaustion vulnerability exists in Conform’s parseSubmission future API when parsing FormData or URLSearchParams submissions with many unique field names.
npm@conform-to/dom
Read check HighCWE-22
electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling
A path traversal vulnerability exists in the Zmodem and Trzsz file download handlers in electerm. When receiving files via Zmodem or Trzsz protocols, electerm uses...
npmelecterm
Read check HighCWE-78
electerm has Command Injection in File System Operations (rmrf, mv, cp)
A command injection vulnerability exists in electerm’s file system operations (rmrf, mv, cp) in src/app/lib/fs.js. These functions construct shell commands by interpolating file paths directly...
npmelecterm
Read check HighCWE-940
Electerm Local code through electerm's single-instance socket
No description available.
npmelecterm
Read check HighCWE-94
@enclave-vm/core is vulnerable to Sandbox Escape
It is possible to escape the security boundraries set by @enclave-vm/core, which can be used to achieve remote code execution (RCE).
npm@enclave-vm/core
Read check HighCWE-78
karma-mojo enables OS Command Injection
karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.
npmkarma-mojo
Read check HighCWE-78
Injection in op-browser
op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.
npmop-browser
Read check HighCWE-732
Decompress: Archive extraction can create files and links outside of the target directory
When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that...
npm@xhmikosr/decompress
Read check HighCWE-79
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
Stored XSS vulnerability via unsanitized data-mce-* attributes (data-mce-href, data-mce-src, data-mce-style). Allows attackers to inject malicious values that override safe attributes during serialization, bypassing validation.
npmtinymce
Read check MediumCWE-749
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) - @nuxt/webpack-builder
This is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server...
npm@nuxt/webpack-builder
Read check MediumCWE-749
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
This is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server...
npm@nuxt/rspack-builder
Read check LowCWE-79
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
The /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those...
npm@nuxt/nitro-server
Read check MediumCWE-288
Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
When experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and...
npm@nuxt/nitro-server
Read check HighCWE-94
DbGate: Remote Code Execution via functionName injection in loadReader endpoint
The POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation.
npmdbgate-api
Read check MediumCWE-352
Waku: Cross-Origin CSRF on RSC Server Action Dispatch
Waku’s RSC request dispatcher invokes server actions without validating the request’s Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser...
npmwaku
Read check LowCWE-601
Waku has an Open Redirect via `unstable_redirect` Helper
The unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...
npmwaku
Read check MediumCWE-287
Claw Orchestrator is missing authentication for the component API Endpoint
A weakness has been identified in Enderfga claw-orchestrator up to 3.5.5. This affects the function EmbeddedServer of the file src/embedded-server.ts of the component API Endpoint....
npm@enderfga/claw-orchestrator
Read check MediumCWE-400
Claw Orchestrator has inefficient regular expression complexity via validateRegex()
A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0. The impacted element is the function validateRegex of the file claw-orchestrator/src/embedded-server.ts of the...
npm@enderfga/claw-orchestrator
Read check MediumCWE-79
Potential XSS vulnerability in jQuery - jquery
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery’s DOM manipulation methods (i.e. .html(), .append(), and others) may execute...
npmjquery
Read check MediumCWE-79
LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS
The strip_html filter in liquidjs is intended to remove HTML tags from a string before rendering, and is widely used as an XSS sanitizer. The...
npmliquidjs
Read check MediumCWE-400
LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body
The renderLimit option — documented in docs/source/tutorials/dos.md as the mechanism that “mitigates this by limiting the time consumed by each render() call” — can be...
npmliquidjs
Read check MediumCWE-693
LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`
Context.spawn() in liquidjs creates a child Context for the {% render %} tag but does not propagate the parent context’s resolved ownPropertyOnly value. The new...
npmliquidjs
Read check HighCWE-400
LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)
The date filter’s strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart() in src/util/underscore.ts.
npmliquidjs
Read check HighCWE-1333
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
The built-in strip_html filter in liquidjs uses a regex containing four lazy-quantified alternatives. When the input contains many <script, <style, or <!-- opener tokens without...
npmliquidjs
Read check MediumCWE-285
tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element...
npmtarteaucitronjs
Read check LowCWE-400
DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption
A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component start_search....
npm@wonderwhy-er/desktop-commander
Read check LowCWE-918
DesktopCommanderMCP is vulnerable to SSRF
A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component read_file. Such manipulation of the...
npm@wonderwhy-er/desktop-commander
Read check HighCWE-918
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the current IPv4 validation logic...
npm@fedify/vocab-runtime
Read check LowCWE-1321
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
The _.merge(target, source) utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keys(source). When source was produced by JSON.parse and contains a __proto__...
npm@feathersjs/commons
Read check HighCWE-79
TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments
Stored XSS vulnerability via forged mce:protected comments. Allows attackers to bypass sanitization and inject scripts that execute when content is restored. Impacts users who utilize...
npmtinymce
Read check HighCWE-22
obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr
The Local REST API’s /vault/{path} endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path inside the handler — after Express has already routed and normalized it, then hand...
npmobsidian-local-rest-api
Read check HighCWE-912
Embedded malware in ua-parser-js
The npm package ua-parser-js had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and...
npmua-parser-js
Read check HighCWE-674
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any...
npmprotobufjs
Read check LowCWE-22
@babel/core: Arbitrary File Read via sourceMappingURL Comment
Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these...
npm@babel/core
Read check MediumCWE-754
protobufjs : Schema-derived names can shadow runtime-significant properties
protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or...
npmprotobufjs
Read check MediumCWE-770
protobufjs: Memory amplification from preserved unknown fields in binary decode
protobufjs 8.2.0 added support for preserving unknown fields encountered during binary decode. Affected versions preserved unknown wire elements in message.$unknowns and did not provide a...
npmprotobufjs
Read check HighCWE-130
websocket-driver: Message corruption via abuse of protocol length headers
The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a...
npmwebsocket-driver
Read check MediumCWE-770
websocket-driver: Resource limit bypass via message compression
If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger...
npmwebsocket-driver
Read check HighCWE-1284
ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag
When parsing an image with an embedded ICC profile that contains a crafted multiLocalizedUnicodeType (mluc) tag, ExifReader can be made to allocate memory proportional to...
npmexifreader
Read check MediumCWE-409
ExifReader is vulnerable to denial of service via unbounded decompression of image metadata
Versions of ExifReader from 4.20.0 through 4.38.1 do not bound the size of decompressed metadata blocks. When a caller invokes the asynchronous API (e.g. ExifReader.load(file)...
npmexifreader
Read check MediumCWE-918
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification g
PUT /api/basemap (the basemap import endpoint) fetches an attacker-supplied URL server-side with no SSRF protection whatsoever. Any authenticated user can submit a JSON body {...
npm@tak-ps/cloudtak
Read check HighCWE-94
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
The TypeScript Prompty loader used gray-matter without overriding executable frontmatter engines. gray-matter supports JavaScript frontmatter blocks such as ---js and evaluates them while parsing. An...
npm@prompty/core
Read check MediumCWE-755
ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
ExifReader 4.40.0 can throw an uncaught RangeError: Offset is outside the bounds of the DataView while parsing crafted HEIC/AVIF files. The file only needs a...
npmexifreader
Read check HighCWE-918
CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification
No description available.
npm@tak-ps/cloudtak
Read check HighCWE-791
Angular's deprecated package has a Cross-Site Scripting issue
A flaw in AngularJS’ Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within...
npmangular
Read check HighCWE-668
@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default
@andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default...
npm@andrea9293/mcp-documentation-server
Read check MediumCWE-79
Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
A potential Cross-Site Scripting (XSS) vulnerability exists in Fabric.js due to improper escaping of user-controlled input during SVG serialization via the toSVG() method.
npmfabric
Read check HighCWE-918
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CV
shouldBypassProxy, introduced in v1.15.0 to fix CVE-2025-62718, does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a...
npmaxios
Read check MediumCWE-79
Dash apps vulnerable to Cross-site Scripting - dash-core-components
Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package...
npmdash-core-components
Read check MediumCWE-79
Dash apps vulnerable to Cross-site Scripting
Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package...
npmdash-html-components
Read check MediumCWE-770
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Axios versions starting with 0.28.0 contain uncontrolled recursion in formDataToJSON, which is exposed as axios.formToJSON() and used internally when axios serialises FormData with Content-Type: application/json....
npmaxios
Read check MediumCWE-674
Axios: Excessive recursion in formDataToJSON can cause denial of service
Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON() / named formToJSON API and the default request transform...
npmaxios
Read check HighCWE-918
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints
Users are affected if all of the following are true:
npm@better-auth/sso
Read check HighCWE-918
LobeHub: Unauthenticated SSRF in `/webapi/proxy`
No description available.
npm@lobehub/lobehub
Read check HighCWE-863
@better-auth/sso: SSO provider may allow registration for any org member without a checking their role
You are affected if all of the following are true:
npm@better-auth/sso
Read check LowCWE-79
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
The _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping:
npmdefuddle
Read check HighCWE-404
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
An unauthenticated remote attacker can cause a denial of service in affected versions of engine.io by opening Engine.IO polling sessions and sending an invalid binary...
npmengine.io
Read check MediumCWE-835
protobufjs: Denial of Service via infinite loop in .proto option parsing
protobufjs parsed option names by advancing through schema tokens until it reached an = token, without checking for end of input. A crafted .proto schema...
npmprotobufjs
Read check MediumCWE-1321
protobufjs: Text Format string map parsing can mutate returned map object prototype
The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key __proto__ could therefore change the prototype...
npmprotobufjs
Read check MediumCWE-918
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NO_PROXY rules. In Node.js applications that use HTTP_PROXY or HTTPS_PROXY together...
npmaxios
Read check MediumCWE-1321
Axios: Prototype pollution gadgets can alter axios request construction
axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in...
npmaxios
Read check MediumCWE-770
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
axios’ fetch adapter does not enforce maxBodyLength for live WHATWG ReadableStream request bodies whose size cannot be determined before dispatch. Applications that use adapter: "fetch"...
npmaxios
Read check MediumCWE-400
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2.
npmaxios
Read check MediumCWE-1321
Axios: Nested axios option objects can consume polluted prototype values
Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype.
npmaxios
Read check MediumCWE-674
Axios form serializer maxDepth bypass via {} metatoken
Axios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in lib/helpers/toFormData.js. When serializing an object with a top-level key ending...
npmaxios
Read check HighCWE-200
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before...
npmaxios
Read check HighCWE-306
AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridg
Two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while a sibling handler in the same repo does....
npm@agenticmail/core
Read check MediumCWE-59
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync() to a deterministic runtime path. On typical macOS environments, and on Linux sessions where $XDG_RUNTIME_DIR is...
npmchrome-devtools-mcp
Read check HighCWE-835
jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or...
npmjsrsasign
Read check HighCWE-338
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in...
npmjsrsasign
Read check HighCWE-681
jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can...
npmjsrsasign
Read check HighCWE-347
jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.set
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related...
npmjsrsasign
Read check MediumCWE-697
js-toml has silent type confusion via falsy-primitive duplicate-key bypass
js-toml’s interpreter checks whether a key already exists in a parser-built container with if (object[key]) instead of if (key in object). When the prior value...
npmjs-toml
Read check HighCWE-835
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
List#set, List#setSize, List#setIn, List#updateIn (and the functional set / setIn / updateIn) mishandle an index or size in the range [2 ** 30, 2 **...
npmimmutable
Read check HighCWE-407
Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly.
npmimmutable
Read check HighCWE-407
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
linkify-it’s schema-scan loop (.test() / .match(), the documented public API) invokes the mailto:schema validator at every mailto: occurrence in the input text. For each occurrence...
npmlinkify-it
Read check HighCWE-248
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
@opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent() without handling decode errors. A single request carrying a malformed percent-encoded value (for example a bare %)...
npm@opentelemetry/propagator-jaeger
Read check HighCWE-522
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
This is a credential-exposure / credential-confusion issue.
npm@sigstore/oci
Read check HighCWE-436
fast-uri vulnerable to host confusion via literal backslash authority delimiter
fast-uri v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node’s native WHATWG URL (used by fetch(), undici, and Node’s...
npmfast-uri
Read check HighCWE-22
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
PostCSS’s PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme,...
npmpostcss
Read check HighCWE-770
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling) — sibling class of GHSA-8xx9-69p8-7jp3 and GHSA-2546-xv4c-mc8g, applied to memoryLimit instead of renderLimit
npmliquidjs
Read check MediumCWE-248
SvelteKit: Big remote form function payloads can cause Node process to crash
Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.
npm@sveltejs/kit
Read check MediumCWE-1321
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are...
npm@sveltejs/kit
Read check HighCWE-843
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
A type confusion issue in seroval.fromJSON() allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table...
npmseroval
Read check MediumCWE-755
Valibot: record() issue paths can make flatten() throw for inherited Object property names
valibot 1.4.1 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty.
npmvalibot
Read check HighCWE-94
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
The TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute...
npm@prompty/core
Read check MediumCWE-116
mathlive's Lack of Escaping of HTML allows for XSS - mathlive
Despite the 0.104.0 patch escaping attribute-bearing constructs (\htmlData, \href), text-content reflection was missed. The \text{}, \mbox{} commands accept arbitrary characters in their body and emit...
npmmathlive
Read check HighCWE-78
degit has a Command Injection issue
Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for...
npmdegit
Read check HighCWE-400
d3-color vulnerable to ReDoS
The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service....
npmd3-color
Read check HighCWE-95
AWS Amplify Studio UI Component Properties Has an Input Validation Issue
The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities (components, forms, views, and themes) primarily used in AWS...
npm@aws-amplify/codegen-ui-react
Read check MediumCWE-1321
jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()
Jodit.modules.Helpers.set(chain, value, obj) walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with (or contains) __proto__,...
npmjodit
Read check HighCWE-1321
@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging
A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5.
npm@phun-ky/defaults-deep
Read check MediumCWE-83
Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS
jodit’s sanitizeHTMLElement neutralizes a javascript: href using a bare href.trim().indexOf('javascript') === 0 check. This omits the normalization jodit applies to every other URL attribute: isDangerousUrl...
npmjodit
Read check MediumCWE-1321
Jodit has prototype pollution via Jodit.configure() / ConfigMerge
Jodit.configure(options) — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under...
npmjodit
Read check HighCWE-83
Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
jodit’s built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer’s element walk, so a no-interaction event...
npmjodit
Read check MediumCWE-80
Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization
A <script> element placed directly inside an <svg> (or MathML) container was not removed by Jodit’s clean-html sanitizer.
npmjodit
Read check MediumCWE-79
sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos
sanitize-html uses allowedSchemesAppliedToAttributes (default: ['href', 'src', 'cite']) to gate the naughtyHref() function that blocks dangerous URI schemes like javascript: and vbscript:.
npmsanitize-html
Read check HighCWE-22
Prompty: Arbitrary file read via file reference expansion
Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use...
npm@prompty/core
Read check MediumCWE-22
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `f
The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile() that restricts an attacker-controlled sourceMappingURL (from a CSS comment) to a .map extension and, for...
npmpostcss
Read check HighCWE-754
Socket.IO: Zero-attachment Memory Exhaustion
A specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to...
npmsocket.io-parser
Read check HighCWE-436
fast-uri vulnerable to host confusion via backslash authority introducer
fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority...
npmfast-uri
Read check HighCWE-1333
jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
Before JSONata 2.2.0 and 1.8.9, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex....
npmjsonata
Read check HighCWE-94
Flowise RCE via TypeORM DataSource
============================================================================= Security Advisory elttam
npmflowise-components
Read check HighCWE-95
Flowise Sandbox Escape to RCE
============================================================================= Security Advisory elttam
npmflowise-components
Read check HighCWE-94
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
A sandbox escape vulnerability in executeJavaScriptCode() allows any authenticated user to execute arbitrary system commands as root on the Flowise server.
npmflowise-components
Read check HighCWE-94
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2.
npmflowise-components
Read check HighCWE-94
Flowise RCE via SQLite Record Manager Node
============================================================================= Security Advisory elttam
npmflowise-components
Read check HighCWE-184
Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
The mitigation shipped for CVE-2025-8943 blocks the -y and --yes flags on npx to stop auto-installation of arbitrary packages. That flag filter works. The environment-variable...
npmflowise-components
Read check HighCWE-184
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the...
npmflowise-components
Read check HighCWE-73
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
Flowise on current main allows an authenticated user with documentStores:preview-process permission to trigger the S3 Directory document loader with attacker-controlled S3 object keys.
npmflowise-components
Read check HighCWE-95
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
Flowise’s CSVAgent interpolates an attacker-controlled segment of thecsvFile data URI directly into a Python source-code template that is thenexecuted by Pyodide. Because Pyodide is loaded...
npmflowise-components
Read check HighCWE-94
Flowise: Remote Code Execution Vulnerability in CSVAgent
The CSVAgent node was observed to allow users to write Python code which gets executed via pyodide. The original intent was to allow users to...
npmflowise-components
Read check HighCWE-94
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability - flowise-components
– ABSTRACT ————————————-
npmflowise-components
Read check HighCWE-89
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. escapeValue() dispatches on the type of the parameter value, and two of...
npm@hypequery/clickhouse
Read check MediumCWE-598
@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
UForm and UAuthForm render a server-side <form> element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If...
npm@nuxt/ui
Read check HighCWE-94
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host
Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin.
npm@nuxt/devtools
Read check MediumCWE-835
Mermaid XY Charts are vulnerable to an infinite loop DoS
Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.
npmmermaid
Read check MediumCWE-1321
Mermaid Architecture diagrams are vulnerable to prototype pollution
Rendering an untrusted architecture-beta diagram lets the diagram author write an arbitrary property with the value horizontal or vertical onto Object.prototype. A group id of...
npmmermaid
Read check MediumCWE-94
Mermaid allows CSS injection applying to sibling elements of the diagram
Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with #mermaid-X, sibling (~ and +) combinators can still escape...
npmmermaid
Read check LowCWE-1321
Mermaid configuration APIs allow prototype pollution
Mermaid’s configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid’s internal config using the assignWithDepth deep-merge helper that is vulnerable to...
npmmermaid
Read check MediumCWE-606
Mermaid radar diagrams are vulnerable to DoS
Mermaid radar diagrams allow arbitrary large values for ticks, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until...
npmmermaid
Read check HighCWE-79
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF
If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no...
npmpdfjs-dist
Read check HighCWE-1103
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633
ngx-extended-pdf-viewer embeds a fork of Mozilla’s pdf.js rather than depending on pdfjs-dist, so this vulnerability is not visible to dependency scanners through package.json.
npmngx-extended-pdf-viewer
Read check MediumCWE-1333
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted Accept headers. The impact is mitigated by default header length limits on most platforms, but...
npm@sveltejs/kit
Read check MediumCWE-1321
Axios: Prototype pollution auth subfields can inject Basic auth
Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype...
npmaxios
Read check HighCWE-338
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
CryptoJS.lib.WordArray.random() in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces...
npmcrypto-js
Read check HighCWE-835
nanoid: non-secure generators can loop indefinitely with negative size
nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given...
npmnanoid
Read check MediumCWE-79
showdown allows stored cross-site scripting through table header ID injection
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes.
npmshowdown
Read check MediumCWE-79
showdown metadata title handling allows cross-site scripting
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript.
npmshowdown
Read check HighCWE-22
fast-uri vulnerable to path traversal via percent-encoded dot segments
fast-uri v3.1.0 and earlier decodes percent-encoded path separators (%2F) and dot segments (%2E) before applying dot-segment removal in normalize() and equal(). This makes encoded path...
npmfast-uri
Read check MediumCWE-79
Trix has a Stored XSS vulnerability through serialized attributes
The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer.
npmtrix
Read check LowCWE-79
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when a crafted application/x-trix-document JSON payload is dropped into the editor in environments...
npmtrix
Read check MediumCWE-79
Trix: Stored XSS via HTMLParser attribute injection on paste
The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock...
npmtrix
Read check MediumCWE-79
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
Severity: MediumCVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVSS suggested base score: ~6.1 — Medium *(Re-validate in the first.gov calculator before filing.
npmep_etherpad-lite
Read check MediumCWE-59
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-
src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts both compute their temporary working-file paths as:
npmep_etherpad-lite
Read check MediumCWE-294
ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartex
Etherpad’s device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body
npmep_etherpad-lite
Read check HighCWE-436
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
fast-uri v3.1.1 and earlier decodes percent-encoded authority delimiters (%40 as @, %3A as :) inside the host component and serializes them back as raw characters....
npmfast-uri
Read check HighCWE-835
nanoid: custom generators can loop indefinitely when size is zero
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0,...
npmnanoid
Read check HighCWE-400
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
@anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies —...
npm@anephenix/hub
Read check HighCWE-776
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
fast-xml-parser processes multiple “DOCTYPE” declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities().
npmfast-xml-parser
Read check HighCWE-22
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
File: lib/previous-map.jsLine: 87-98 (loadFile), 129-144 (loadMap)
npmpostcss
Read check MediumCWE-1321
Quasar: Prototype pollution in the extend() utility
[email protected], the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the...
npmquasar
Read check HighCWE-94
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Remote Code Execution (RCE) in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq (“Prototype Pollution in #set path assignment”)...
npmvelocityjs
Read check MediumCWE-94
TypeORM: migration:generate template-literal code injection
typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not ${...}. An attacker who can write schema metadata (column comments, defaults,...
npmtypeorm
Read check HighCWE-551
fast-uri vulnerable to host confusion via failed IDN canonicalization
fast-uri versions >= 2.3.1, <= 4.0.0 fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls URL.domainToASCII(...) on the global WHATWG URL...
npmfast-uri
Read check HighCWE-407
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly.
npmimmutable
Read check Medium
Vulnerable Apache Version
The Apache HTTP Server version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the server,...
ApacheWeb ServerOutdated
Read check Medium
Vulnerable Nginx Version
The Nginx version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the server, leading to...
NginxWeb ServerOutdated
Read check Medium
Vulnerable OpenSSL Version
The OpenSSL version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the server, leading to...
OpenSSLEncryptionOutdated
Read check Medium
Vulnerable PHP Version
The PHP version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the server, leading to...
PHPWeb ServerOutdated
Read check Medium
Vulnerable Tomcat Version
The Apache Tomcat version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the server, leading...
TomcatWeb ServerOutdated
Read check High
Vulnerable WordPress Version
The WordPress version used is outdated and has security flaws. Vulnerabilities in older versions could be exploited by attackers to compromise the website, leading to...
WordpressOutdated
Read check