Explore packages and vulnerabilities by …
Operating system
Infrastructure as Code
Vulnerabilities from the last week
Cross-site Scripting (XSS)
NO KNOWN SECURITY ISSUESRECOGNIZEDHEALTHYACTIVE
@vaadin/charts is a vaadin-charts
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious data into configuration options such as additionalOptions, updateConfiguration, or text fields that accept markup. This can lead to unauthorized actions or data exposure if user-controlled input is not properly sanitized.
Server-side Request Forgery (SSRF)
Affects
crewai-tools is a Set of tools for the crewAI framework
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via SeleniumScrapingTool, which never applies the validate_url private-address check before passing attacker-controlled URLs to headless Chrome. An attacker who can influence agent tool input through prompt injection can direct the browser to loopback, RFC 1918, or cloud metadata addresses, disclosing internal data and cloud credentials.
Cross-site Scripting (XSS)
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the chart configuration process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by injecting malicious data into configuration options such as additionalOptions, updateConfiguration, or text fields that accept markup. This can lead to unauthorized actions or data exposure if user-controlled input is not properly sanitized.
Recent vulnerabilities disclosed by Snyk
- M
Cross-site Scripting (XSS) in nice-select2 (npm)- C
Malicious Package in cacheutilskit (npm)- C
Malicious Package in byteutilsbox (npm)- C
Malicious Package in streamlyx (npm)- H
Directory Traversal in zip-lib (npm)
Snyk security
researchers
have disclosed
3506
vulnerabilities
About Snyk dependencies vulnerability database
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.
