Vulnerabilities
Last updated 1 hour ago
| Package | Summary | Severity | Published | Modified |
|---|---|---|---|---|
age
|
Malicious plugin names, recipients, or identities can cause arbitrary binary execution | Unknown | 1 year ago | 3 hours ago |
imagesharp
|
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp | High Risk 7.5 | 5 days ago | 6 hours ago |
@pinecone-experience/messages
|
Malicious code in @pinecone-experience/messages (npm) | Unknown | 6 days ago | 7 hours ago |
|
@galicia-toolkit/tag-manager
|
Malicious code in @galicia-toolkit/tag-manager (npm) | Unknown | 4 days ago | 15 hours ago |
|
some-very-long-package-name
|
Malicious code in some-very-long-package-name (npm) | Unknown | 1 day ago | 1 day ago |
agent-vx
|
Malicious code in agent-vx (PyPI) | Unknown | 2 days ago | 1 day ago |
|
agentaix
|
Malicious code in agentaix (PyPI) | Unknown | 2 days ago | 1 day ago |
|
media-manager5
|
Malicious code in media-manager5 (PyPI) | Unknown | 2 days ago | 1 day ago |
github.com/luskaner/ageLANServer/server
|
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service | High Risk 7.5 | 3 days ago | 3 days ago |
|
praisonaiagents
|
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments | Medium Risk 6.1 | 4 days ago | 4 days ago |
|
praisonaiagents
|
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets | Critical 10.0 | 4 days ago | 4 days ago |
|
praisonaiagents
|
PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace | Medium Risk 5.7 | 4 days ago | 4 days ago |
|
praisonaiagents
|
PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow | High Risk 7.8 | 4 days ago | 4 days ago |
|
praisonaiagents
|
PraisonAI: SkillTools Executes Scripts Without Path Containment Validation | High Risk 8.1 | 4 days ago | 4 days ago |
|
praisonaiagents
|
PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification | High Risk 8.4 | 4 days ago | 4 days ago |
|
praisonaiagents
|
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure | High Risk 8.5 | 4 days ago | 4 days ago |
|
praisonaiagents
|
PraisonAI: Project config can auto-save agent output outside the project root | Medium Risk 6.0 | 4 days ago | 4 days ago |
|
connector-agent
|
Malicious code in connector-agent (npm) | Unknown | 4 days ago | 4 days ago |
|
link-status-page
|
Malicious code in link-status-page (npm) | Unknown | 12 days ago | 4 days ago |
|
sixlabors.imagesharp
|
ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflate | Medium Risk 5.9 | 5 days ago | 5 days ago |
|
sixlabors.imagesharp
|
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer | High Risk 7.5 | 5 days ago | 5 days ago |
|
praisonaiagents
|
PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass | High Risk 8.5 | 5 days ago | 5 days ago |
|
sixlabors.imagesharp
|
ImageSharp: ICC LUT16 output channel count can write beyond Vector4 | High Risk 7.5 | 5 days ago | 5 days ago |
|
sixlabors.imagesharp
|
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions | Medium Risk 5.3 | 5 days ago | 5 days ago |
|
sixlabors.imagesharp
|
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer | High Risk 7.5 | 5 days ago | 5 days ago |
|
sixlabors.imagesharp
|
ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loop | Medium Risk 5.3 | 5 days ago | 5 days ago |
|
sixlabors.imagesharp
|
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index | High Risk 7.5 | 5 days ago | 5 days ago |
drupal/entity_reference_manager
|
No summary available | Unknown | 5 days ago | 5 days ago |
|
@backstage/plugin-scaffolder-backend
|
Backstage: Incorrect authorization in scaffolder task listing | Medium Risk 4.3 | 5 days ago | 5 days ago |
|
@backstage/plugin-techdocs-backend
|
Backstage: Improper input validation in TechDocs static content requests | Medium Risk 6.5 | 5 days ago | 5 days ago |
|
@backstage/plugin-catalog-backend
|
Backstage: Inconsistent enforcement of allowed location types during catalog processing | Low Risk 3.1 | 5 days ago | 5 days ago |
|
@backstage/plugin-techdocs-backend
|
Backstage: Improper authorization enforcement for TechDocs static content | Medium Risk 6.5 | 5 days ago | 5 days ago |
|
@backstage/plugin-scaffolder-backend-module-confluence-to-markdown
|
Backstage: Improper input validation in Confluence to Markdown scaffolder module | Medium Risk 6.3 | 5 days ago | 5 days ago |
|
@backstage/backend-defaults
|
Backstage: Improper input validation in cloud storage URL readers | Medium Risk 4.4 | 5 days ago | 5 days ago |
|
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud
|
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions | High Risk 8.5 | 5 days ago | 5 days ago |
|
@backstage/plugin-scaffolder-backend-module-bitbucket-server
|
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions | High Risk 8.5 | 5 days ago | 5 days ago |
|
@backstage/plugin-kubernetes-backend
|
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend | Low Risk 3.5 | 5 days ago | 5 days ago |
|
@backstage/plugin-scaffolder-backend
|
Backstage may expose sensitive information in Scaffolder task failure events | Medium Risk 5.3 | 5 days ago | 5 days ago |
|
@backstage/plugin-techdocs-node
|
Backstage has potential file exposure through local TechDocs publisher | Medium Risk 5.3 | 5 days ago | 5 days ago |
|
@backstage/plugin-techdocs-node
|
Backstage has improper input validation in TechDocs Markdown extension configuration | High Risk 7.7 | 5 days ago | 5 days ago |
|
@backstage/plugin-scaffolder-backend
|
Backstage has sensitive information exposure in scaffolder task logs | Medium Risk 6.5 | 5 days ago | 5 days ago |
|
@backstage/plugin-techdocs-node
|
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend | High Risk 7.7 | 5 days ago | 5 days ago |
|
@backstage/plugin-scaffolder-backend
|
Backstage has improper input validation in scaffolder task list ordering | Medium Risk 5.3 | 5 days ago | 5 days ago |
|
@backstage/plugin-techdocs-node
|
Backstage: Improper validation of MkDocs theme configuration in TechDocs | High Risk 7.7 | 5 days ago | 5 days ago |
|
imagesharp
|
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write | High Risk 7.5 | 5 days ago | 5 days ago |
|
praisonaiagents
|
PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands | Medium Risk 5.5 | 3 months ago | 5 days ago |
|
alexa-cybertron-team-code-review-agent
|
Malicious code in alexa-cybertron-team-code-review-agent (npm) | Unknown | 12 days ago | 7 days ago |
|
a11y-tabindex-manager
|
Malicious code in a11y-tabindex-manager (npm) | Unknown | 7 days ago | 7 days ago |
|
monitoring-agent
|
Malicious code in monitoring-agent (npm) | Unknown | 7 days ago | 7 days ago |
|
probe-image-size
|
probe-image-size: Quadratic-time Denial of Service in the SVG Parser | High Risk 7.5 | 9 days ago | 9 days ago |
Page 1