report@snyk.io
organization01
Rollen
Rollen dieser Identität.
02
Referenzen
Weitere Namen und Kennungen dieser Entität.
nvdUS report@snyk.io
03
bewertete Schwachstellen (723)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-87803US | —OT erhöht | — | ||
An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint… | ||||
| CVE-2026-17528US | — | — | ||
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that is rendered… | ||||
| CVE-2026-17524US | — | — | ||
Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypa… | ||||
| CVE-2026-16266US | — | — | ||
Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype cha… | ||||
| CVE-2026-12866US | — | — | ||
All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions tha… | ||||
| CVE-2026-12644US | — | — | ||
Versions of the package ts-deepmerge before 8.0.0 are vulnerable to Uncaught Exception due to the improper handling of built-in Object.prototype methods (such as toString, valueOf)… | ||||
| CVE-2026-11572US | — | — | ||
Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands direct… | ||||
| CVE-2026-10732US | — | — | ||
All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same p… | ||||
| CVE-2026-9673US | — | — | ||
Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject fo… | ||||
| CVE-2026-9496US | — | — | ||
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by sup… | ||||
| CVE-2026-9495US | — | — | ||
Versions of the package @koa/router from 14.0.0 and before 15.0.0 are vulnerable to Access Control Bypass due to the middleware being silently dropped from the execution chain when… | ||||
| CVE-2026-8814US | — | — | ||
Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without e… | ||||
| CVE-2026-8813US | — | — | ||
This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record si… | ||||
| CVE-2026-8657US | — | — | ||
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attac… | ||||
| CVE-2026-8656US | — | — | ||
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper sanitization of JSON values and property… | ||||
| CVE-2025-13030US | critical9.8OT erhöht | — | ||
All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An attacker can upload malicious files and… | ||||
| CVE-2026-6951US | — | Exploit | ||
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-S… | ||||
| CVE-2026-5160US | — | — | ||
Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalizati… | ||||
| CVE-2026-4603US | medium5.3 | — | ||
Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction… | ||||
| CVE-2026-4602US | — | — | ||
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can for… | ||||