snyk

Latest CVEs · RSS

• CVE-2026-87803 2026-09-10 · CVSS 7.1
  An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db a
• CVE-2026-17528 2026-07-28 · CVSS 6.1
  Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payl
• CVE-2026-17524 2026-07-28 · CVSS 7.5
  Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process.
• CVE-2026-16266 2026-07-21 · CVSS 4.0
  Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the Java
• CVE-2026-12866 2026-06-23 · CVSS 9.8
  All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying cra
• CVE-2026-12644 2026-06-19 · CVSS 5.3
  Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such a
• CVE-2026-11572 2026-06-09 · CVSS 8.8
  Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git s
• CVE-2026-10732 2026-06-05 · CVSS 6.4
  All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two ent
• CVE-2026-9673 2026-05-28 · CVSS 6.8
  Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An at
• CVE-2026-9496 2026-05-26 · CVSS 7.5
  Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this
• CVE-2026-9495 2026-05-26 · CVSS 7.3
  Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the
• CVE-2026-8814 2026-05-19 · CVSS 5.3
  Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTX
• CVE-2026-8813 2026-05-19 · CVSS 7.5
  This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together w
• CVE-2026-8657 2026-05-16 · CVSS 8.2
  Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.pa
• CVE-2026-8656 2026-05-16 · CVSS 6.1
  Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper sanitization of JSON
• CVE-2025-13030 2026-04-30 · CVSS 7.1
  All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload
• CVE-2026-6951 2026-04-25 · CVSS 9.8
  Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.sn
• CVE-2026-5160 2026-04-15 · CVSS 6.1
  Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL valida
• CVE-2026-4603 2026-03-23 · CVSS 5.9
  Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger
• CVE-2026-4601 2026-03-23 · CVSS 8.7
  Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA sign
• CVE-2026-4599 2026-03-23 · CVSS 9.1
  Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax
• CVE-2026-4598 2026-03-23 · CVSS 7.5
  Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse imp
• CVE-2026-4602 2026-03-23 · CVSS 7.5
  Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js.
• CVE-2026-4600 2026-03-23 · CVSS 7.4
  Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJ
• CVE-2026-4258 2026-03-17 · CVSS 7.5
  Versions of the package sjcl before 1.0.9 are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ec