Priority HIGH 72
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the li…
CVSS 4.0HIGH 8.5· Network · Low privileges · User interaction · EPSS 0.02315 · Published 2026-08-28 · Fixed in 3.8.8 CWE-78
Priority MEDIUM 61
The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2;…
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.03225 · Published 2022-11-30 · Partial fix · 1.1064.0, 2.31.3 +6 CWE-78
Priority MEDIUM 58
The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00513 · Published 2023-04-20 · Fixed in 2023-03-28 CWE-79
Priority MEDIUM 48
safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.02876 · Published 2019-10-15 · Fixed in 1.3.2 CWE-94
Priority MEDIUM 47
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.05006 · Published 2019-07-25 · Partial fix · 4.17.12, 4.17.14 +2 CWE-1321
Priority MEDIUM 46
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01968 · Published 2020-02-18 · Fixed in 0.1.10 CWE-78
Priority MEDIUM 46
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.01787 · Published 2019-10-15 · Fixed in 1.3.4 CWE-94
Priority MEDIUM 45
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01392 · Published 2020-01-22 · Fixed in 1.6.9 CWE-668
Priority LOW 39
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00791 · Published 2022-11-30 · Fixed in 1.1064.0 CWE-78
Priority LOW 38
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag.
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.02088 · Published 2019-08-05 · Fixed in v1.16.0, v6.45.0 CWE-522
Priority LOW 37
Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent.
CVSS 3.1HIGH 8.1· Local · No auth · No interaction · EPSS 0.00245 · Published 2024-12-06 · No fix listed CWE-94
Priority LOW 36
This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00624 · Published 2023-02-28 · Fixed in 2.0.0 CWE-287
Priority LOW 35
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project.
CVSS 4.0HIGH 7.5· Network · No auth · User interaction · EPSS 0.00469 · Published 2024-10-23 · Fixed in 1.1294.0, 4.5.0 CWE-78
Priority LOW 35
The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project.
CVSS 4.0HIGH 7.5· Network · No auth · User interaction · EPSS 0.00469 · Published 2024-10-23 · Fixed in 1.1294.0, 1.10.0 CWE-78
Priority LOW 35
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00612 · Published 2022-10-03 · Partial fix · 1.996.0, 1.19.1 CWE-78
Priority LOW 31
Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.0126 · Published 2020-02-19 · Fixed in 6.3.1 CWE-113
Priority LOW 30
undefsafe before 2.0.3 is vulnerable to Prototype Pollution.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.01089 · Published 2020-02-18 · Fixed in 2.0.3 CWE-74
Priority LOW 30
dot-object before 2.1.3 is vulnerable to Prototype Pollution.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.01098 · Published 2020-02-18 · Fixed in 2.1.3 CWE-74
Priority LOW 30
bodymen before 1.1.1 is vulnerable to Prototype Pollution.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.0096 · Published 2020-02-18 · Fixed in 1.1.1 CWE-74
Priority LOW 29
All versions of component-flatten are vulnerable to Prototype Pollution.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00726 · Published 2020-02-18 · No fix listed CWE-74
Priority LOW 26
This affects the package snyk-broker before 4.73.0.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01628 · Published 2022-07-25 · Fixed in 4.73.0 CWE-22
Priority LOW 14
Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs.
CVSS 4.0LOW 2.4· Local · High privileges · User interaction · EPSS 0.00179 · Published 2025-06-26 · Fixed in 1.1297.3 CWE-532
THREATIST.IORead the docs