Total
424146 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-25875 | 1 Svelte | 1 Svelte | 2026-06-17 | 4.3 MEDIUM | 5.4 MEDIUM |
| The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function. | |||||
| CVE-2022-25873 | 1 Vuetifyjs | 1 Vuetify | 2026-06-17 | N/A | 4.6 MEDIUM |
| The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component. | |||||
| CVE-2022-25872 | 1 Fast String Search Project | 1 Fast String Search | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| All versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for any non-string input as the source. This allows the attacker to read previously allocated memory. | |||||
| CVE-2022-25871 | 1 Querymen Project | 1 Querymen | 2026-06-17 | 5.0 MEDIUM | 5.9 MEDIUM |
| All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867). | |||||
| CVE-2022-25869 | 1 Angularjs | 1 Angularjs | 2026-06-17 | N/A | 4.2 MEDIUM |
| All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements. | |||||
| CVE-2022-25867 | 1 Socket | 1 Socket.io-client Java | 2026-06-17 | N/A | 7.5 HIGH |
| The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format. | |||||
| CVE-2022-25866 | 1 Git-php Project | 1 Git-php | 2026-06-17 | 7.5 HIGH | 8.1 HIGH |
| The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. | |||||
| CVE-2022-25865 | 1 Microsoft | 1 Workspace-tools | 2026-06-17 | 7.5 HIGH | 8.1 HIGH |
| The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. | |||||
| CVE-2022-25864 | 1 Intel | 1 Oneapi Math Kernel Library | 2026-06-17 | N/A | 6.7 MEDIUM |
| Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access. | |||||
| CVE-2022-25862 | 1 Sds Project | 1 Sds | 2026-06-17 | 5.0 MEDIUM | 4.0 MEDIUM |
| This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-7618](https://security.snyk.io/vuln/SNYK-JS-SDS-564123) | |||||
| CVE-2022-25860 | 1 Simple-git Project | 1 Simple-git | 2026-06-17 | N/A | 8.1 HIGH |
| Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221). | |||||
| CVE-2022-25858 | 1 Terser | 1 Terser | 2026-06-17 | N/A | 5.3 MEDIUM |
| The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions. | |||||
| CVE-2022-25857 | 2 Debian, Snakeyaml Project | 2 Debian Linux, Snakeyaml | 2026-06-17 | N/A | 7.5 HIGH |
| The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. | |||||
| CVE-2022-25856 | 1 Argo Events Project | 1 Argo Events | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ... | |||||
| CVE-2022-25855 | 1 Create-choo-app3 Project | 1 Create-choo-app3 | 2026-06-17 | N/A | 7.4 HIGH |
| All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. | |||||
| CVE-2022-25854 | 1 Tagify Project | 1 Tagify | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload. | |||||
| CVE-2022-25853 | 1 Semver-tags Project | 1 Semver-tags | 2026-06-17 | N/A | 7.4 HIGH |
| All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization. | |||||
| CVE-2022-25852 | 2 Libpq Project, Pg-native Project | 2 Libpq, Pg-native | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq. | |||||
| CVE-2022-25851 | 1 Jpeg-js Project | 1 Jpeg-js | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return. | |||||
| CVE-2022-25850 | 1 Proxyscotch Project | 1 Proxyscotch | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server. | |||||