PkgSeer

Vulnerabilities

Last updated 9 minutes ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
astro Astro: XSS via attribute injection in dynamic tag names Low Risk 3.0 2 hours ago 1 hour ago
astro Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems Medium Risk 6.0 2 hours ago 2 hours ago
@astrojs/node Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems Medium Risk 6.0 2 hours ago 2 hours ago
@astrojs/solid-js Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js Low Risk 3.0 22 hours ago 22 hours ago
@astrojs/svelte Astro: Reflected XSS via unescaped slot names in @astrojs/svelte Low Risk 3.0 22 hours ago 22 hours ago
astro Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering Medium Risk 6.5 22 days ago 22 days ago
astro Astro: Arbitrary CSS injection in Astro View Transitions Low Risk 3.0 22 days ago 22 days ago
@astrojs/netlify Astro: Netlify Image CDN allowlist bypass enables SSRF Medium Risk 6.0 1 month ago 1 month ago
@astrojs/node Astro: Malformed port in the Host header can crash the Node adapter High Risk 8.0 1 month ago 1 month ago
@clerk/astro Clerk has an authorization bypass when combining organization, billing, or reverification checks High Risk 8.1 6 months ago 2 months ago
@kindspells/astro-shield In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists High Risk 7.5 2 years ago 2 months ago
@kindspells/astro-shield Content-Security-Policy header generation in middleware could be compromised by malicious injections High Risk 7.5 2 years ago 2 months ago
@sentry/astro Sentry's Astro SDK vulnerable to ReDoS High Risk 7.5 2 years ago 2 months ago
astro Astro: Remote code execution through AVIF image optimization Critical 9.8 2 months ago 2 months ago
astro Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base Medium Risk 6.0 2 months ago 2 months ago
@astrojs/vercel Astro: Unauthenticated path override in the @astrojs/vercel ISR function Medium Risk 6.5 3 months ago 2 months ago
@astrojs/netlify @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped Low Risk 3.7 3 months ago 3 months ago
astro Astro: Reflected XSS via unescaped View Transition animation properties Medium Risk 6.0 3 months ago 3 months ago
astro Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered Medium Risk 6.0 3 months ago 3 months ago
astro Astro: Host header SSRF in prerendered error page fetch High Risk 7.5 5 months ago 3 months ago
astro Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands Low Risk 3.0 3 months ago 3 months ago
astro Astro: Reflected XSS via unescaped slot name High Risk 7.1 5 months ago 3 months ago
@astrojs/rss @astrojs/rss: XML Injection via Unescaped RSS Feed Fields Medium Risk 4.3 3 months ago 3 months ago
astro Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) Medium Risk 6.0 3 months ago 3 months ago
@astrojs/node @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect Low Risk 3.0 3 months ago 3 months ago
@depup/astro Malicious code in @depup/astro (npm) Unknown 3 months ago 3 months ago
@sentry/astro Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true` Medium Risk 6.0 11 months ago 3 months ago
astroboa_cli Malicious code in astroboa_cli (RubyGems) Unknown 2 years ago 3 months ago
astro Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch High Risk 8.2 3 months ago 3 months ago
@astrojs/netlify @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config Medium Risk 5.3 5 months ago 3 months ago
astro Astro: XSS via Unescaped Attribute Names in Spread Props Medium Risk 4.2 5 months ago 3 months ago
astropy RCE in TranformGraph().to_dot_graph function High Risk 8.4 2 years ago 4 months ago
astropy RCE in TranformGraph().to_dot_graph function High Risk 8.4 4 months ago 4 months ago
astro Astro: Server island encrypted parameters vulnerable to cross-component replay Medium Risk 6.1 6 months ago 6 months ago
@clerk/astro Official Clerk JavaScript SDKs: Middleware-based route protection bypass Critical 9.1 7 months ago 6 months ago
astro Astro: XSS in define:vars via incomplete </script> tag sanitization Medium Risk 6.1 6 months ago 6 months ago
@astrojs/cloudflare Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) Low Risk 2.2 6 months ago 6 months ago
@astrojs/node Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed Medium Risk 5.3 6 months ago 6 months ago
astro Astro: Remote allowlist bypass via unanchored matchPathname wildcard Medium Risk 5.3 7 months ago 7 months ago
@astrojs/node Astro has Full-Read SSRF in error rendering via Host: header injection High Risk 8.6 8 months ago 7 months ago
@astrojs/node Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands Medium Risk 5.9 7 months ago 7 months ago
@astrojs/vercel Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` Medium Risk 6.5 7 months ago 7 months ago
astrono2mio Malicious code in astrono2mio (PyPI) Unknown 1 year ago 7 months ago
astronomio Malicious code in astronomio (PyPI) Unknown 1 year ago 7 months ago
astronomios Malicious code in astronomios (PyPI) Unknown 1 year ago 7 months ago
@astrojs/node Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize Medium Risk 6.5 8 months ago 8 months ago
@astrojs/node Astro has memory exhaustion DoS due to missing request body size limit in Server Actions Medium Risk 5.9 8 months ago 8 months ago
astro Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values Medium Risk 6.0 11 months ago 9 months ago
astro Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 Medium Risk 6.5 11 months ago 9 months ago
astro Astros's duplicate trailing slash feature leads to an open redirection security issue Medium Risk 6.0 1 year ago 11 months ago
Data courtesy of OSV.dev
Page 1