Ecosystem
Wolfi
8,505 known vulnerabilities.
Most affected packages
559 results · Clear filters · Feed
-
Low 3.7
joi: object().rename() with a template target can set the validated object's prototype
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression sour…
-
Low 3.7
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild o…
-
Low 2.9
FFmpeg before 9.0 has an out-of-bounds read because the copied extradata lacked required padding before GetBitContext-b…
-
Low 3.7
qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)
### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat k…
-
Low 3.1
filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the s…
-
Low 3.1
filebrowser through 2.63.23 Stale Share Link via File Rename
filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share record is keyed by path, so it survives the rename and remains dormant (returning 404 while the path is empty). When any …
-
Low 3.1
File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion
File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without …
-
Low 3.7
NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView
NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumpti…
-
Low 3.1
Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote…
-
Low 3.4
Out of bounds read in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the r…
-
Low 3.1
Information leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the rend…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the…
-
Low 3.1
Improper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comprom…
-
Low 3.1
Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comp…
-
Low 3.1
Information leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the r…
-
Low 3.1
Incomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromis…
-
Low 2.9
Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to …
-
Low 3.1
Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comp…
-
Low 3.1
Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compr…
-
Low 2.9
Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to …
-
Low 3.1
Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comp…
-
Low 3.1
Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comp…
-
Low 3.1
Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compro…
-
Low 3.1
Missing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromis…
-
Low 3.1
Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromi…
-
Low 3.1
Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromis…
-
Low 3.1
Improper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compr…
-
Low 3.1
Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the re…
-
Low 3.1
Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site …
-
Low 3.1
Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the rend…
-
Low 3.1
Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromise…
-
Low 3.1
Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised th…
-
Low 3.1
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the…
-
Low 3.1
Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the…
-
Low 2.1
zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits
When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
-
Low 2.5
NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusReader pathsec Bypass
NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. _load_lang_ngrams joins the corpus root with crubadan_code, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open()…
-
Low 2.3
BuildKit: Possible runtime DoS via unbounded group parsing
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a u…
-
Low 3.8
PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership
Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. I…
-
Low 3.8
PostgreSQL ECPG integer underflow can crash the client
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside at…
-
Low 2.3
Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the H…