Explore packages and vulnerabilities by …
Operating system
Infrastructure as Code
Vulnerabilities from the last week
Malicious Package
Affects
postcss-semantic-themes is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.
Out-of-bounds Write (HTTP2Shell)
Affects
brotlicffi is a Python CFFI bindings to the Brotli library
Affected versions of this package are vulnerable to Out-of-bounds Write (HTTP2Shell) via block-switch handling in the Brotli decoder, specifically DecodeBlockTypeAndLength in deps/brotli/c/dec/decode.c. An attacker can execute arbitrary code by supplying a crafted Brotli-compressed stream with an invalid block switch to the code that decodes it; the decoder fails to propagate the block-switch error during command processing, allowing the out-of-bounds write.
Regular Expression Denial of Service (ReDoS)
org.apache.directory.api:api-ldap-model is a Common LDAP Model used by clients and servers.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the TelephoneNumberSyntaxChecker and FacsimileTelephoneNumberSyntaxChecker in LDAP schema syntax validation. An attacker can trigger catastrophic regular-expression backtracking by sending a malformed telephone number, such as a long run of digits followed by an invalid character, to an LDAP server using the API. Processing the value can consume 100% of a CPU core indefinitely, severely degrading or denying LDAP service.
Recent vulnerabilities disclosed by Snyk
- M
Cross-site Scripting (XSS) in nice-select2 (npm)- C
Malicious Package in cacheutilskit (npm)- C
Malicious Package in byteutilsbox (npm)- C
Malicious Package in streamlyx (npm)- H
Directory Traversal in zip-lib (npm)
Snyk security
researchers
have disclosed
3506
vulnerabilities
About Snyk dependencies vulnerability database
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.
