Ecosystem
Wolfi
8,530 known vulnerabilities.
Most affected packages
3,545 results · Clear filters · Feed
-
High 7.5
Cache Poisoning in next.js
Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this craft…
-
High 8.8
Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corr…
-
High 8.8
Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exp…
-
High 7.5
An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigatio…
-
High 7.3
Tampering by prototype polution in DOMPurify
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to…
-
High 7.5
CVE-2024-38816: Path traversal vulnerability in functional web frameworks
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the p…
-
High 8.8
Type Confusion in V8 in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit object c…
-
High 8.8
Use after free in Autofill in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potentially…
-
High 8.8
Use after free in Media Router in Google Chrome on Android prior to 128.0.6613.137 allowed a remote attacker to potenti…
-
High 8.8CVE-2024-8636 Public exploit
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit …
-
High 7.5CVE-2024-45590 Public exploit
body-parser vulnerable to denial of service when url encoding is enabled
body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denia…
-
High 7.5
path-to-regexp outputs backtracking regular expressions
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, …
-
High 7.4
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL wh…
-
High 8.1
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions…
-
High 7.5
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using…
-
High 7.7
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This …
-
High 7.5
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--al…
-
High 8.8
Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised…
-
High 8.8
Apache Airflow: Command Injection in an example DAG
Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - …
-
High 7.5
Stack exhaustion in Parse in go/build/constraint
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
-
High 7.5
Stack exhaustion in Decoder.Decode in encoding/gob
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
-
High 7.5
Type Confusion in Async Generators in Javascript Engine
An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.1…
-
High 8.8
Out of bounds write in V8 in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit hea…
-
High 8.8
Use after free in WebAudio in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit he…
-
High 7.5CVE-2024-6119 EPSS 67%
Possible denial of service in X.509 name checks
Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of…
-
High 7.5
Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme tha…
-
High 8.8
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for t…
-
High 7.5CVE-2024-6232 Public exploit
Regular-expression DoS when parsing TarFile headers
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
-
High 7.5
Denial of service in quinn-proto when using `Endpoint::retry()`
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is possible for a server to `accept()`, `retry()`, `refuse()`, or `ignore()` an `Incoming` connection. However, calling `retry()` on an unval…
-
High 7.3
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_gro…
-
High 7.3
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts o…
-
High 7.5CVE-2024-8198 Public exploit
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the…
-
High 8.8CVE-2024-8193 Public exploit
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the…
-
High 7.5
Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap cor…
-
High 8.7
Infinite loop when iterating over zip archive entry names from zipfile.Path
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfil…
-
High 7.0
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker t…
-
High 7.3
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker t…
-
High 7.8
Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker t…
-
High 8.8
Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of b…
-
High 8.8
Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially…