PkgSeer

Vulnerabilities

Last updated 1 hour ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
h2 h2 unbounded empty DATA frames Unknown 1 month ago 3 hours ago
github.com/oauth2-proxy/oauth2-proxy/v7 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing Critical 9.1 6 months ago 17 days ago
github.com/oauth2-proxy/oauth2-proxy OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing in github.com/oauth2-proxy/oauth2-proxy Unknown 3 months ago 17 days ago
github.com/oauth2-proxy/oauth2-proxy/v7 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing in github.com/oauth2-proxy/oauth2-proxy Unknown 3 months ago 17 days ago
test1hh235 Malicious code in test1hh235 (npm) Unknown 21 days ago 21 days ago
h2 h2: Duplicate Host header could facilitate request smuggling Medium Risk 5.3 2 months ago 1 month ago
org.apache.httpcomponents.core5:httpcore5-h2 Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK High Risk 7.5 3 months ago 1 month ago
oauth2 OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host High Risk 8.6 2 months ago 1 month ago
php-standard-library/h2 PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling High Risk 7.5 3 months ago 1 month ago
org.springframework.security:spring-security-oauth2-jose Spring Security has Potential Security Misconfiguration when Using withIssuerLocation Medium Risk 5.3 5 months ago 1 month ago
golang.org/x/oauth2 golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability High Risk 7.5 1 year ago 1 month ago
h2 h2 allows HTTP Request Smuggling due to illegal characters in headers Medium Risk 6.0 1 year ago 1 month ago
github.com/oauth2-proxy/oauth2-proxy/v7 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion Critical 9.1 1 year ago 1 month ago
org.openidentityplatform.openam:openam-oauth2 OpenAM FreeMarker template injection High Risk 8.8 2 years ago 1 month ago
h2 Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS) Medium Risk 6.0 2 years ago 1 month ago
league/oauth2-server league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase High Risk 8.2 3 years ago 1 month ago
h2o H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint High Risk 7.5 1 year ago 1 month ago
ai.h2o:h2o-core H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint High Risk 7.5 1 year ago 1 month ago
com.h2database:h2 Password exposure in H2 Database High Risk 7.8 3 years ago 1 month ago
io.micronaut.security:micronaut-security-oauth2 io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud Medium Risk 6.5 3 years ago 1 month ago
h2 h2 servers vulnerable to degradation of service with CONTINUATION Flood Medium Risk 5.3 2 years ago 1 month ago
github.com/oauth2-proxy/oauth2-proxy Open Redirect in OAuth2 Proxy High Risk 7.1 4 years ago 1 month ago
github.com/oauth2-proxy/oauth2-proxy Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy Medium Risk 5.4 5 years ago 1 month ago
github.com/oauth2-proxy/oauth2-proxy/v7 Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy Medium Risk 5.4 5 years ago 1 month ago
drupal/oauth2_client No summary available Unknown 1 year ago 1 month ago
drupal/oauth2_server No summary available Unknown 1 year ago 1 month ago
ash_authentication_oauth2_server ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection Unknown 1 month ago 1 month ago
ash_authentication_oauth2_server ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF Unknown 1 month ago 1 month ago
ash_authentication_oauth2_server ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint Unknown 1 month ago 1 month ago
ash_authentication_oauth2_server Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server Unknown 1 month ago 1 month ago
ash_authentication_oauth2_server ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls Unknown 1 month ago 1 month ago
ash_authentication_oauth2_server ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion Unknown 1 month ago 1 month ago
h2-codex Malicious code in h2-codex (npm) Unknown 1 month ago 1 month ago
3layerdipstackr4geh2 Malicious code in 3layerdipstackr4geh2 (npm) Unknown 1 month ago 1 month ago
classlink-x8inh2p5 Malicious code in classlink-x8inh2p5 (npm) Unknown 1 month ago 1 month ago
classlink-fr0zh2sv Malicious code in classlink-fr0zh2sv (npm) Unknown 1 month ago 1 month ago
3layerdipstacksh21o Malicious code in 3layerdipstacksh21o (npm) Unknown 1 month ago 1 month ago
3layerdipstackj3eh2 Malicious code in 3layerdipstackj3eh2 (npm) Unknown 1 month ago 1 month ago
org.apache.cxf:cxf-rt-rs-security-oauth2 Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService Medium Risk 6.5 4 months ago 1 month ago
org.apache.cxf:cxf-rt-rs-security-oauth2 Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing High Risk 7.4 4 months ago 1 month ago
org.apache.cxf:cxf-rt-rs-security-oauth2 Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier High Risk 8.2 4 months ago 1 month ago
org.apache.cxf:cxf-rt-rs-security-oauth2 Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control Critical 9.8 4 months ago 1 month ago
org.apache.cxf:cxf-rt-rs-security-oauth2 Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator Critical 9.1 4 months ago 1 month ago
org.apache.cxf:cxf-rt-rs-security-oauth2 Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection Medium Risk 6.5 4 months ago 1 month ago
org.springframework.security:spring-security-oauth2-authorization-server Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter Medium Risk 6.1 4 months ago 2 months ago
h2 h2: Duplicate Host header could facilitate request smuggling Medium Risk 5.3 2 months ago 2 months ago
hello-world-test-mh2 Malicious code in hello-world-test-mh2 (PyPI) Unknown 2 months ago 2 months ago
org.hswebframework.web:hsweb-authorization-oauth2 hsweb-framework has an open redirect issue Medium Risk 4.3 4 months ago 2 months ago
org.openidentityplatform.openam:openam-oauth2 OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page Medium Risk 6.1 2 months ago 2 months ago
zvfossilc41xzth215 Malicious code in zvfossilc41xzth215 (RubyGems) Unknown 3 months ago 2 months ago
Data courtesy of OSV.dev
Page 1