We’ve disclosed3397vulnerabilities
by Snyk Security
Researchers
Snyk Vulnerability Database
The leading database for open source vulnerabilities and cloud misconfigurations.
Improper Neutralization of Quoting Syntax
Affecting postgresql package, versions [,13.19) , [14.0,14.16) , [15.0,15.11) , [16.0,16.7) , [17.0,17.3)
How to fix?
Upgrade postgresql to version 13.19, 14.16, 15.11, 16.7, 17.3 or higher.
Vulnerabilities from the last week
Malicious Package
Affects
architecture-viewer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.
Denial of Service (DoS)
Affects
litellm is a Library to easily interface with LLM API providers
Affected versions of this package are vulnerable to Denial of Service (DoS) through the use of ast.literal_eval to parse user input.
Server-side Request Forgery (SSRF)
Affects
org.webjars.bower:axios is a promise-based HTTP client for the browser and Node.js.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to not setting allowAbsoluteUrls to false by default when processing a requested URL in buildFullPath(). It may not be obvious that this value is being used with the less safe default, and URLs that are expected to be blocked may be accepted. This is a bypass of the fix for the vulnerability described in CVE-2025-27152.
Recent vulnerabilities disclosed by Snyk
- H
Server-Side Request Forgery (SSRF) in nossrf (npm)- H
Cross-site Scripting (XSS) in phpoffice/phpexcel (composer)- C
Embedded Malicious Code in cdn-icon-fetcher-help (npm)- C
Embedded Malicious Code in cdn-icon-fetch (npm)- M
Insertion of Sensitive Information into Log File in ray (pip)
About Snyk
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.
