https://vulnogram.org/ Most recent CVEs assigned by Snyk (snyk). https://vulnogram.org/seaview/icons/snyk.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-87803 https://vulnogram.org/CVE-2026-87803 An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage… High Thu, 10 Sep 2026 09:54:01 GMT https://vulnogram.org/CVE-2026-17528 https://vulnogram.org/CVE-2026-17528 Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary… Medium Network Exploitable Tue, 28 Jul 2026 05:00:01 GMT https://vulnogram.org/CVE-2026-17524 https://vulnogram.org/CVE-2026-17524 Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intend… High Network Exploitable Tue, 28 Jul 2026 05:00:00 GMT https://vulnogram.org/CVE-2026-16266 https://vulnogram.org/CVE-2026-16266 Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such a… Medium Network Exploitable Tue, 21 Jul 2026 05:00:00 GMT https://vulnogram.org/CVE-2026-12866 https://vulnogram.org/CVE-2026-12866 All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-con… Critical Network Exploitable Tue, 23 Jun 2026 05:00:00 GMT https://vulnogram.org/CVE-2026-12644 https://vulnogram.org/CVE-2026-12644 Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf). When user-controlled input contains these keys with non-function val… Medium Network Exploitable Fri, 19 Jun 2026 05:00:00 GMT https://vulnogram.org/CVE-2026-11572 https://vulnogram.org/CVE-2026-11572 Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRefs() funct… High Network Exploitable Tue, 09 Jun 2026 05:00:04 GMT https://vulnogram.org/CVE-2026-10732 https://vulnogram.org/CVE-2026-10732 All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second… High Network Exploitable Fri, 05 Jun 2026 05:00:02 GMT https://vulnogram.org/CVE-2026-9673 https://vulnogram.org/CVE-2026-9673 Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spre… High Thu, 28 May 2026 05:00:02 GMT https://vulnogram.org/CVE-2026-9496 https://vulnogram.org/CVE-2026-9496 Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the functi… High Network Exploitable Tue, 26 May 2026 05:00:07 GMT https://vulnogram.org/CVE-2026-9495 https://vulnogram.org/CVE-2026-9495 Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the ski… Medium Network Exploitable Tue, 26 May 2026 05:00:04 GMT https://vulnogram.org/CVE-2026-8814 https://vulnogram.org/CVE-2026-8814 Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size. When asynchronou… Medium Network Exploitable Tue, 19 May 2026 05:00:09 GMT https://vulnogram.org/CVE-2026-8813 https://vulnogram.org/CVE-2026-8813 This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record an… High Network Exploitable Tue, 19 May 2026 05:00:04 GMT https://vulnogram.org/CVE-2026-8657 https://vulnogram.org/CVE-2026-8657 Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON… High Network Exploitable Sat, 16 May 2026 05:00:09 GMT https://vulnogram.org/CVE-2026-8656 https://vulnogram.org/CVE-2026-8656 Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper sanitization of JSON values and property names. If an application compares untrusted JSON/object data and rend… Medium Network Exploitable Sat, 16 May 2026 05:00:04 GMT https://vulnogram.org/CVE-2025-13030 https://vulnogram.org/CVE-2025-13030 All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and achieve arbitrary code execution since this endpoint lacks authenticat… Medium Network Exploitable Thu, 30 Apr 2026 05:00:05 GMT https://vulnogram.org/CVE-2026-6951 https://vulnogram.org/CVE-2026-6951 Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --c… Critical Network Exploitable Sat, 25 Apr 2026 05:00:05 GMT https://vulnogram.org/CVE-2026-5160 https://vulnogram.org/CVE-2026-5160 Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based chec… Medium Network Exploitable Wed, 15 Apr 2026 05:00:01 GMT https://vulnogram.org/CVE-2026-4603 https://vulnogram.org/CVE-2026-4603 Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations… Medium Mon, 23 Mar 2026 05:00:14 GMT https://vulnogram.org/CVE-2026-4601 https://vulnogram.org/CVE-2026-4601 Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero,… Critical Network Exploitable Mon, 23 Mar 2026 05:00:13 GMT https://vulnogram.org/CVE-2026-4599 https://vulnogram.org/CVE-2026-4599 Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover t… Critical Network Exploitable Mon, 23 Mar 2026 05:00:12 GMT https://vulnogram.org/CVE-2026-4598 https://vulnogram.org/CVE-2026-4598 Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process per… High Network Exploitable Mon, 23 Mar 2026 05:00:11 GMT https://vulnogram.org/CVE-2026-4602 https://vulnogram.org/CVE-2026-4602 Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signature v… High Network Exploitable Mon, 23 Mar 2026 05:00:10 GMT https://vulnogram.org/CVE-2026-4600 https://vulnogram.org/CVE-2026-4600 Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2.0.js). An… Critical Network Exploitable Mon, 23 Mar 2026 05:00:08 GMT https://vulnogram.org/CVE-2026-4258 https://vulnogram.org/CVE-2026-4258 Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending cra… High Network Exploitable Tue, 17 Mar 2026 05:00:04 GMT https://vulnogram.org/CVE-2026-3884 https://vulnogram.org/CVE-2026-3884 Versions of the package spin.js before 3.0.0 are vulnerable to Cross-site Scripting (XSS) via the spin() function that allows a creation of more than 1 alert for each 'target' element. An attacker would need to set an arbitrary key-value pair on Obje… Medium Network Exploitable Wed, 11 Mar 2026 05:00:09 GMT https://vulnogram.org/CVE-2026-3455 https://vulnogram.org/CVE-2026-3455 Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by… Medium Network Exploitable Tue, 03 Mar 2026 05:00:11 GMT https://vulnogram.org/CVE-2026-3449 https://vulnogram.org/CVE-2026-3449 Versions of the package @tootallnate/once before 3.0.1 are vulnerable to Incorrect Control Flow Scoping in promise resolving when AbortSignal option is used. The Promise remains in a permanently pending state after the signal is aborted, causing any… Medium Tue, 03 Mar 2026 05:00:01 GMT https://vulnogram.org/CVE-2026-2739 https://vulnogram.org/CVE-2026-2739 This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely. Medium Network Exploitable Fri, 20 Feb 2026 05:00:08 GMT https://vulnogram.org/CVE-2026-2469 https://vulnogram.org/CVE-2026-2469 Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping… High Sat, 14 Feb 2026 05:00:05 GMT https://vulnogram.org/CVE-2026-2327 https://vulnogram.org/CVE-2026-2327 Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of the regex /\*+$/ in the linkify function. An attacker can supply a long sequence of * characters follow… Medium Network Exploitable Thu, 12 Feb 2026 05:00:07 GMT https://vulnogram.org/CVE-2026-1615 https://vulnogram.org/CVE-2026-1615 Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to h… Critical Network Exploitable Mon, 09 Feb 2026 05:00:09 GMT https://vulnogram.org/CVE-2026-0858 https://vulnogram.org/CVE-2026-0858 Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML diagram can inject malicious JavaS… Medium Network Exploitable Fri, 16 Jan 2026 05:00:06 GMT https://vulnogram.org/CVE-2025-14546 https://vulnogram.org/CVE-2025-14546 Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state gene… Medium Fri, 19 Dec 2025 05:00:02 GMT https://vulnogram.org/CVE-2025-14896 https://vulnogram.org/CVE-2025-14896 due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious Vega diagram specification that will allow them to send requests to any URL, including loc… High Network Exploitable Thu, 18 Dec 2025 16:20:15 GMT https://vulnogram.org/CVE-2025-14284 https://vulnogram.org/CVE-2025-14284 Versions of the package @tiptap/extension-link before 2.10.4 are vulnerable to Cross-site Scripting (XSS) due to unsanitized user input allowed in setting or toggling links. An attacker can execute arbitrary JavaScript code in the context of the appl… Medium Network Exploitable Tue, 09 Dec 2025 05:00:03 GMT https://vulnogram.org/CVE-2025-12758 https://vulnogram.org/CVE-2025-12758 Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in… High Network Exploitable Thu, 27 Nov 2025 05:00:01 GMT https://vulnogram.org/CVE-2025-12613 https://vulnogram.org/CVE-2025-12613 Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a variety… High Network Exploitable Mon, 10 Nov 2025 05:00:08 GMT https://vulnogram.org/CVE-2025-11849 https://vulnogram.org/CVE-2025-11849 Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnera… Medium Network Exploitable Fri, 17 Oct 2025 05:00:06 GMT https://vulnogram.org/CVE-2025-11570 https://vulnogram.org/CVE-2025-11570 Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient filtering of data. **Note:** This is exploitable only if the code is executed outside of Drupal; the functi… Medium Fri, 10 Oct 2025 05:00:07 GMT https://vulnogram.org/CVE-2025-11362 https://vulnogram.org/CVE-2025-11362 Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding. An attacker can cause the application to crash or become… High Network Exploitable Tue, 07 Oct 2025 05:00:04 GMT https://vulnogram.org/CVE-2025-11149 https://vulnogram.org/CVE-2025-11149 This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package fails to catch an exception when user input includes null bytes. This allows attackers to access http://host/%00 and crash the se… High Network Exploitable Tue, 30 Sep 2025 05:00:07 GMT https://vulnogram.org/CVE-2025-11148 https://vulnogram.org/CVE-2025-11148 All versions of the package check-branches are vulnerable to Command Injection check-branches is a command-line tool that is interacted with locally, or via CI, to confirm no conflicts exist in git branches. However, the library follows these convent… Critical Network Exploitable Tue, 30 Sep 2025 05:00:06 GMT https://vulnogram.org/CVE-2025-3193 https://vulnogram.org/CVE-2025-3193 Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "e… High Network Exploitable Sat, 27 Sep 2025 05:00:07 GMT https://vulnogram.org/CVE-2025-10954 https://vulnogram.org/CVE-2025-10954 Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input causing a "run… Medium Network Exploitable Sat, 27 Sep 2025 05:00:00 GMT https://vulnogram.org/CVE-2025-9910 https://vulnogram.org/CVE-2025-9910 Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used… Low Network Exploitable Thu, 11 Sep 2025 05:00:02 GMT https://vulnogram.org/CVE-2025-8264 https://vulnogram.org/CVE-2025-8264 Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allo… Critical Network Exploitable Tue, 29 Jul 2025 05:00:00 GMT https://vulnogram.org/CVE-2025-8267 https://vulnogram.org/CVE-2025-8267 Versions of the package ssrfcheck before 1.2.0 are vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. Specifically, the package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast)… High Network Exploitable Mon, 28 Jul 2025 05:00:00 GMT https://vulnogram.org/CVE-2025-8021 https://vulnogram.org/CVE-2025-8021 All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside of the intended directory. High Network Exploitable Wed, 23 Jul 2025 05:00:03 GMT https://vulnogram.org/CVE-2025-8020 https://vulnogram.org/CVE-2025-8020 All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges i… High Network Exploitable Wed, 23 Jul 2025 05:00:01 GMT