We’ve disclosed3417vulnerabilities
by Snyk Security
Researchers
Snyk Vulnerability Database
The leading database for open source vulnerabilities and cloud misconfigurations.
Improper Neutralization of Quoting Syntax
Affecting postgresql package, versions [,13.19) , [14.0,14.16) , [15.0,15.11) , [16.0,16.7) , [17.0,17.3)
How to fix?
Upgrade postgresql to version 13.19, 14.16, 15.11, 16.7, 17.3 or higher.
Vulnerabilities from the last week
Cross-site Scripting (XSS)
Affects
uikit is a lightweight and modular front-end framework for developing fast and powerful web interfaces.
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the data-caption attribute due to insufficient input sanitisation and output escaping. An attacker can execute arbitrary web scripts in the context of another user by injecting malicious content as a user with Contributor-level access or higher.
Note:
The underlying 'uikit' package behavior is exposed by other packages such as 'Element Pack Addons' for Elementor plugin for WordPress. 'Element Pack Addons' has mitigated the issue in version 8.1.0.
Out-of-Bounds
Affects
Pillow is a PIL (Python Imaging Library) fork.
Affected versions of this package are vulnerable to Out-of-Bounds. Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.
Cross-site Scripting (XSS)
org.webjars.bowergithub.uikit:uikit is a lightweight and modular front-end framework for developing fast and powerful web interfaces.
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the data-caption attribute due to insufficient input sanitisation and output escaping. An attacker can execute arbitrary web scripts in the context of another user by injecting malicious content as a user with Contributor-level access or higher.
Note:
The underlying 'uikit' package behavior is exposed by other packages such as 'Element Pack Addons' for Elementor plugin for WordPress. 'Element Pack Addons' has mitigated the issue in version 8.1.0.
Recent vulnerabilities disclosed by Snyk
- L
Insertion of Sensitive Information into Log File in snyk (npm)- H
Files or Directories Accessible to External Parties in mcp-markdownify-server (npm)- H
Server-Side Request Forgery (SSRF) in mcp-markdownify-server (npm)- M
Incorrect Behavior Order: Early Validation in lockfile-lint-api (npm)- M
Cross-site Scripting (XSS) in raylib (conan)
About Snyk
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.
