PkgSeer

Vulnerabilities

Last updated 54 minutes ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
tornado Tornado: Open redirect via triple-slash redirect paths Low Risk 3.1 5 hours ago 4 hours ago
tornado Tornado: Quadratic CPU usage when parsing HTTP headers with line folding Medium Risk 5.3 16 days ago 16 days ago
tornado Tornado: Open redirect in RedirectHandler via protocol-relative URLs Low Risk 3.0 16 days ago 16 days ago
tornado Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks Medium Risk 5.3 16 days ago 16 days ago
tornado tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM High Risk 7.5 1 month ago 1 month ago
tornado Tornado: StaticFileHandler follows symlinks outside static root (path traversal) High Risk 8.0 1 month ago 1 month ago
tornado Tornado: Unbounded query-string argument count allows event-loop-stalling DoS Medium Risk 5.3 1 month ago 1 month ago
tornado Tornado has a CRLF injection in CurlAsyncHTTPClient headers Medium Risk 6.5 2 years ago 1 month ago
tornado Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado Medium Risk 5.3 2 years ago 1 month ago
tornado tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) Medium Risk 6.0 2 months ago 1 month ago
tornado Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse Medium Risk 5.9 5 months ago 1 month ago
tornado Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths Medium Risk 6.0 3 years ago 1 month ago
tornado Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` Low Risk 3.0 2 months ago 1 month ago
tornado Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop High Risk 7.5 2 months ago 2 months ago
tornado Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop High Risk 7.5 2 months ago 2 months ago
tornado tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) High Risk 7.5 5 months ago 2 months ago
tornado Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient High Risk 7.7 5 months ago 2 months ago
tornado Tornado has out-of-bounds memory access via C extension Low Risk 3.7 5 months ago 2 months ago
tornado Tornado has cookie attribute injection via .RequestHandler.set_cookie High Risk 7.2 7 months ago 2 months ago
tornado Tornado is vulnerable to DoS due to too many multipart parts High Risk 7.5 8 months ago 2 months ago
tornado Tornado has incomplete validation of cookie attributes Medium Risk 5.4 8 months ago 2 months ago
tornado Tornado vulnerable to excessive logging caused by malformed multipart form data High Risk 7.5 1 year ago 2 months ago
tornado Tornado has an HTTP cookie parsing DoS vulnerability High Risk 7.5 1 year ago 2 months ago
tornado Tornado: Quadratic DoS via Repeated Header Coalescing High Risk 7.5 3 months ago 3 months ago
tornado Tornado: Quadratic DoS via Crafted Multipart Parameters High Risk 7.5 3 months ago 3 months ago
tornado Tornado vulnerable to Header Injection and XSS via reason argument Medium Risk 5.4 3 months ago 3 months ago
tornado No summary available Medium Risk 5.3 7 months ago 4 months ago
tornado Tornado has out-of-bounds memory access via C extension Low Risk 3.7 4 months ago 4 months ago
tornado tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) High Risk 7.5 4 months ago 4 months ago
tornado Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient High Risk 7.7 4 months ago 4 months ago
tornado No summary available High Risk 7.5 11 months ago 4 months ago
tornado No summary available Medium Risk 6.1 11 months ago 4 months ago
tornado No summary available High Risk 7.5 11 months ago 4 months ago
tornado Tornado vulnerable to excessive logging caused by malformed multipart form data High Risk 7.5 4 months ago 4 months ago
tornado Tornado has an HTTP cookie parsing DoS vulnerability High Risk 7.5 4 months ago 4 months ago
tornado No summary available Unknown 14 years ago 5 months ago
tornado No summary available Unknown 6 years ago 5 months ago
tornado No summary available Unknown 3 years ago 5 months ago
tornado No summary available High Risk 7.5 8 months ago 5 months ago
tornado Open redirect in Tornado Medium Risk 6.1 3 years ago 1 year ago
bonfire-tornado-fdr646-project Malicious code in bonfire-tornado-fdr646-project (npm) Unknown 1 year ago 1 year ago
blossom-tornado-ljs889-project Malicious code in blossom-tornado-ljs889-project (npm) Unknown 1 year ago 1 year ago
dewdrop-tornado-foo170-project Malicious code in dewdrop-tornado-foo170-project (npm) Unknown 1 year ago 1 year ago
ecosystem-tornado-vgj614-project Malicious code in ecosystem-tornado-vgj614-project (npm) Unknown 1 year ago 1 year ago
galaxy-tornado-tkv3 Malicious code in galaxy-tornado-tkv3 (npm) Unknown 1 year ago 1 year ago
gorilla-tornado-qal524-project Malicious code in gorilla-tornado-qal524-project (npm) Unknown 1 year ago 1 year ago
harbor-tornado-gaq963-project Malicious code in harbor-tornado-gaq963-project (npm) Unknown 1 year ago 1 year ago
hill-tornado-pds437-project Malicious code in hill-tornado-pds437-project (npm) Unknown 1 year ago 1 year ago
hollow-tornado-itq402-project Malicious code in hollow-tornado-itq402-project (npm) Unknown 1 year ago 1 year ago
jasmine-tornado-kvy749-project Malicious code in jasmine-tornado-kvy749-project (npm) Unknown 1 year ago 1 year ago
Data courtesy of OSV.dev
Page 1