Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-29hq-23m2-2j47
  • npm/@sync-in/server
 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory) 22 Sep
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-jx63-h26r-8cph
  • npm/@sync-in/server
 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters` 22 Sep
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-92cr-jxw4-5wjg
  • npm/@sync-in/server
 Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token` 22 Sep
  • Fix available
  • Severity - 8.1 (High)
GHSA-274f-6w77-8qm9
  • npm/@sync-in/server
 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register` 22 Sep
  • Fix available
  • Severity - 6.8 (Medium)
MAL-2026-16374
  • npm/test-react-app-in
 Malicious code in test-react-app-in (npm) 22 Sep
  • No fix available
MAL-2026-15562
  • npm/test-in-one
 Malicious code in test-in-one (npm) 29 Aug
  • No fix available
MAL-2026-14068
  • npm/depcruise-wrap-stream-in-html
 Malicious code in depcruise-wrap-stream-in-html (npm) 15 Aug
  • No fix available
MAL-2026-13982
  • npm/in-install
 Malicious code in in-install (npm) 13 Aug
  • No fix available
MAL-2026-11980
  • npm/pob-test-package-in-monorepo
 Malicious code in pob-test-package-in-monorepo (npm) 04 Aug
  • No fix available
MAL-2026-11981
  • npm/pob-test-typescript-package-in-monorepo
 Malicious code in pob-test-typescript-package-in-monorepo (npm) 04 Aug
  • No fix available
GHSA-p849-8hwh-84j9
  • npm/@nocobase/plugin-notification-in-app-message
 NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE 31 Jul
  • Fix available
  • Severity - 10.0 (Critical)
MAL-2026-10123
  • npm/dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm
 Malicious code in dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm (npm) 10 Jul
  • No fix available
MAL-2026-10122
  • npm/dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto
 Malicious code in dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto (npm) 10 Jul
  • No fix available
MAL-2026-6990
  • npm/ai-gen-ai-opt-in
 Malicious code in ai-gen-ai-opt-in (npm) 08 Jul
  • No fix available
MAL-2026-6761
  • npm/gen-ai-opt-in
 Malicious code in gen-ai-opt-in (npm) 05 Jul
  • No fix available
GHSA-q4x5-8cj6-52wg
  • npm/@sync-in/server
 Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP 05 Jun
  • Fix available
  • Severity - 7.7 (High)
Load more...