CWE-1395: Dependency on Vulnerable Third-Party Component
The product has a dependency on a third-party component that contains one or more known vulnerabilities.
A kind of CWE-1357 Reliance on Insufficiently Trustworthy Component.
From the CWE List. © The MITRE Corporation.
Newest
- No product listed XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder No score
- checkmk gmbh checkmk Trust of compromised eMudhra root CA in bundled CA stores 7.1 High
-
pillowPyPI Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() 8.1 High - code16 sharp Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders 8.4 High
- tryghost ghost Ghost: Remote Code Execution via Bookmark Card Images 8.8 High
- vercel next.js Next.js: Denial of Service in App Router using Server Actions 8.2 High
- wikimedia foundation mediawiki - datatransfer extension DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) 7.5 High
- cisa malcolm Dependency on vulnerable third-party component in Malcolm 6.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Windows Secure Boot Security Feature Bypass Vulnerability 4.4 Medium
- sap se netweaver as java (adobe document services) Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services) 6.3 Medium
-
matrix-commanderPyPI olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193 No score - zapad image::webp Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp 9.8 Critical
- felipe toml::xs TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99 9.8 Critical
- oracle platform security for java Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware ... 8.8 High
- code16 sharp Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability 8.9 High
- logto-io logto Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers 8.5 High
-
gogs.io/gogsGo Gogs: XSS in .ipynb files renderer due to outdated notebookjs 8.5 High -
github.com/opentofu/opentofuGo,rootio-github.com/opentofu/opentofuRoot +1 more OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL 7.5 High -
cryptographyPyPI Vulnerable OpenSSL included in cryptography wheels 7.5 High - adobe dreamweaver, dreamweaver desktop +1 more Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395) 8.6 High
- hcl ireflection HCL iReflection Use of Third party vulnerable and outdated components issue was detected in the web application. 3.1 Low
- ditec a.s. d.launcher 2 Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks 6.5 Medium
- hcl bigfix service management (sm), hcltech bigfix service management +1 more HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version' 4.0 Medium
- hitachi vantara pentaho data integration and analytics, hitachi vantara pentaho data integration and analytics +1 more Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component 9.1 Critical
- adobe commerce, commerce b2b, magento +2 more +4 more Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) 7.5 High
- adobe commerce, commerce b2b, magento +2 more +4 more Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395) 5.3 Medium
- kmx alien::freeimage Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries 7.3 High
- hcl dfxanalytics HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability 3.7 Low
-
@excalidraw/excalidrawnpm,@excalidraw/mermaid-to-excalidrawnpm +1 more Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) No score - atrodo net::dropbear, net\ +1 more Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt 10.0 Critical
-
github.com/opentofu/opentofuGo OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses 3.1 Low -
@lightdash/clinpm Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions 9.6 Critical - usebruno bruno Axios npm Supply Chain Incident Impacting @usebruno/cli 9.8 Critical
-
mcp-handlernpm mcp-handler has a tool response leak across concurrent client sessions ('Race Condition') 7.1 High -
EnhancedLinq.AsyncNuGet EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory 7.5 High - yves sereal::encoder, sereal\ +1 more Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library 8.1 High
- yves sereal::decoder, sereal\ +1 more Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library 8.1 High
- perl Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib 9.8 Critical
-
github.com/traefik/traefikGo,github.com/traefik/traefik/v2Go,github.com/traefik/traefik/v3Go +2 more Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) 7.8 High -
postiznpm Postiz App has a High-Severity SSRF Vulnerability via Next.js 7.5 High -
c2cciutilsPyPI C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922) 7.5 High -
com.splunk:splunk-otel-javaagentMaven splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution 9.3 Critical -
fido2-libnpm fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing 7.5 High -
skia-pythonPyPI skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version 8.1 High -
github.com/modelcontextprotocol/go-sdkGo Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk 8.2 High -
github.com/argoproj-labs/terraform-provider-argocdGo Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 4.8 Medium - microsoft zero-shot-scfoundation, github repo: zero shot scfoundation +1 more GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability 8.8 High
- tokuhirom unqlite UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library 9.8 Critical
- pmqs compress::raw::zlib, compress\ +1 more Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib 9.8 Critical
-
github.com/traefik/traefikGo,github.com/traefik/traefik/v2Go,github.com/traefik/traefik/v3Go +2 more Traefik affected by TLS ClientAuth Bypass on HTTP/3 7.8 High - Show olderLoading…