Vulnerabilities
Last updated 46 minutes ago
| Package | Summary | Severity | Published | Modified |
|---|---|---|---|---|
rack
|
Rack: Multipart parsing allows DoS via unbounded scan buffer growth | High Risk 7.5 | 9 hours ago | 9 hours ago |
|
rack
|
Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass | Low Risk 3.7 | 9 hours ago | 9 hours ago |
|
rack
|
Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835 | Medium Risk 4.8 | 9 hours ago | 9 hours ago |
|
rack
|
Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch | Medium Risk 5.3 | 10 hours ago | 10 hours ago |
wallet-tracking
|
Malicious code in wallet-tracking (PyPI) | Unknown | 11 months ago | 7 days ago |
passwordcracker
|
Malicious code in passwordcracker (npm) | Unknown | 1 month ago | 7 days ago |
|
passwordcrackv2
|
Malicious code in passwordcrackv2 (npm) | Unknown | 1 month ago | 7 days ago |
|
@johnruff215-dev/solana-wallet-tracker
|
Malicious code in @johnruff215-dev/solana-wallet-tracker (npm) | Unknown | 13 days ago | 9 days ago |
|
epic-tracking
|
Malicious code in epic-tracking (npm) | Unknown | 1 year ago | 1 month ago |
|
@sourceflow-uk/sourceflow-tracker
|
Malicious code in @sourceflow-uk/sourceflow-tracker (npm) | Unknown | 5 months ago | 1 month ago |
|
rack_envinspector
|
Malicious code in rack_envinspector (RubyGems) | Unknown | 2 years ago | 1 month ago |
|
chai-tracker
|
Malicious code in chai-tracker (npm) | Unknown | 3 months ago | 1 month ago |
|
chai-as-crack
|
Malicious code in chai-as-crack (npm) | Unknown | 1 month ago | 1 month ago |
|
meraz-project-tracker
|
Malicious code in meraz-project-tracker (npm) | Unknown | 1 month ago | 1 month ago |
|
@merazmz/project-tracker
|
Malicious code in @merazmz/project-tracker (npm) | Unknown | 1 month ago | 1 month ago |
|
tracker-cloudflare
|
Malicious code in tracker-cloudflare (npm) | Unknown | 2 months ago | 2 months ago |
|
@grackle-ai/powerline
|
Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true) | High Risk 8.0 | 4 months ago | 2 months ago |
|
@grackle-ai/runtime-sdk
|
Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true) | High Risk 8.0 | 4 months ago | 2 months ago |
|
rack
|
Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values | Medium Risk 4.8 | 7 months ago | 2 months ago |
|
rack
|
Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header | High Risk 7.5 | 7 months ago | 2 months ago |
|
rack
|
Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass. | Medium Risk 5.3 | 7 months ago | 2 months ago |
|
rack
|
Rack's multipart byte range processing allows denial of service via excessive overlapping ranges | Medium Risk 5.3 | 7 months ago | 2 months ago |
|
rack
|
Rack has Content-Length mismatch in Rack::Files error responses | Medium Risk 4.8 | 7 months ago | 2 months ago |
|
rack
|
Rack:: Static header_rules bypass via URL-encoded paths | Medium Risk 5.3 | 7 months ago | 2 months ago |
|
rack
|
Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing | Medium Risk 4.8 | 7 months ago | 2 months ago |
|
rack
|
Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect | Medium Risk 5.9 | 7 months ago | 2 months ago |
|
rack
|
Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads | High Risk 7.5 | 7 months ago | 2 months ago |
|
rack
|
Rack::Static prefix matching can expose unintended files under the static root | High Risk 7.5 | 7 months ago | 2 months ago |
|
rack
|
Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters | High Risk 7.5 | 1 year ago | 2 months ago |
|
rack
|
Rack has a Possible Information Disclosure Vulnerability | Medium Risk 5.8 | 1 year ago | 2 months ago |
|
rack-session
|
Rack session gets restored after deletion | Medium Risk 4.2 | 1 year ago | 2 months ago |
|
rack
|
Rack has an Unbounded-Parameter DoS in Rack::QueryParser | High Risk 7.5 | 1 year ago | 2 months ago |
|
@grackle-ai/auth
|
Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR) | High Risk 8.0 | 4 months ago | 2 months ago |
|
@grackle-ai/mcp
|
Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR) | High Risk 8.0 | 4 months ago | 2 months ago |
|
@grackle-ai/plugin-core
|
Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR) | High Risk 8.0 | 4 months ago | 2 months ago |
|
rack
|
Rack::Request accepts invalid Host characters, enabling host allowlist bypass | Medium Risk 4.8 | 7 months ago | 2 months ago |
|
rack
|
Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters | High Risk 7.5 | 7 months ago | 2 months ago |
|
rack
|
Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory | Medium Risk 5.3 | 7 months ago | 2 months ago |
|
rack-session
|
Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization | Critical 9.5 | 7 months ago | 2 months ago |
|
rack
|
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href | Medium Risk 5.4 | 8 months ago | 2 months ago |
|
rack
|
Rack has a Directory Traversal via Rack:Directory | High Risk 7.5 | 8 months ago | 2 months ago |
|
rack
|
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) | High Risk 7.5 | 1 year ago | 2 months ago |
|
rack
|
Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) | High Risk 7.5 | 1 year ago | 2 months ago |
|
rack
|
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) | High Risk 7.5 | 1 year ago | 2 months ago |
|
rack
|
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing | High Risk 7.5 | 1 year ago | 2 months ago |
|
rack
|
ReDoS Vulnerability in Rack::Multipart handle_mime_head | Medium Risk 6.0 | 1 year ago | 2 months ago |
|
rack
|
Rack session gets restored after deletion | Medium Risk 4.2 | 1 year ago | 2 months ago |
|
rack
|
Possible Log Injection in Rack::CommonLogger | Medium Risk 6.5 | 1 year ago | 2 months ago |
|
rack
|
Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection | Medium Risk 6.0 | 1 year ago | 2 months ago |
|
rack-contrib
|
rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter | High Risk 8.6 | 2 years ago | 2 months ago |
Page 1