Snyk Security Database

flowise-ui is a

Affected versions of this package are vulnerable to Missing Authorization in the /api/v1/files route, which lacks proper permission checks for file listing and deletion operations. An attacker can access and remove files belonging to other workspaces within the same organization by using a low-privileged API key.

zenml is a ZenML: Write production-ready ML code.

Affected versions of this package are vulnerable to Missing Authorization in the get_deployed_stack endpoint. An attacker can access sensitive information, including infrastructure topology, service connector details, stack ownership, and deployment metadata, by sending authenticated requests to the affected endpoint, which lacks proper authorization checks. This exposure may enable cross-tenant reconnaissance and facilitate further attacks in multi-tenant environments.

org.webjars.npm:crypto-js is a library of crypto standards.

Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the WordArray.random function. An attacker can recover security-sensitive values by enumerating the reduced output space of the underlying pseudo-random number generator. This is only exploitable if the application uses the affected function to generate security-sensitive values.