CWE-1395: Dependency on Vulnerable Third-Party Component
The product has a dependency on a third-party component that contains one or more known vulnerabilities.
A kind of CWE-1357 Reliance on Insufficiently Trustworthy Component.
From the CWE List. © The MITRE Corporation.
Newest
github.com/cheqd/cheqd-nodeGocheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)No scoreopenh264-sys2crates.ioOpenH264 Rust API Openh264 Decoding Functions Heap Overflow Vulnerability8.6 Highrudloff/rtmpdump-binPackagistMultiple rtmpdump vulnerabilitiesNo score- ni data record ad, flexrio, frc game tools +4 more +6 moreDependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision Software7.0 High
Umbraco.Headless.Client.NetNuGetThe Umbraco Heartcore headless client library uses a vulnerable Refit dependency packageNo scoreorg.jboss.hal:hal-consoleMavenCross Site Scripting (XSS) vulnerability while uploading content to a new deployment6.9 Medium- woodruffw pyrageMalicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage7.7 High
github.com/ryanbekhen/nanoproxyGoPotential Vulnerabilities Due to Outdated golang.org/x/crypto Dependency in NanoProxyNo score- gfi archiverGFI Archiver Telerik Web UI Remote Code Execution Vulnerability9.8 Critical
mermaidnpmPrototype pollution vulnerability found in Mermaid's bundled version of DOMPurify7.0 Highcurl-cffiPyPIcurl_cffi bundles a version of libcurl affected by High Severity vulnerabilityNo scorepl.allegro.tech.hermes:hermes-managementMavenhermes-management is vulnerable to RCE due to Apache commons-jxpath9.3 Criticalkimai/kimaiPackagistKimai has an XXE Leading to Local File Read8.5 High- cern indicoIndico has a Cross-Site-Scripting during account creation4.3 Medium
- openssl, netapp bootstrap os, brocade fabric operating system +9 more +11 moreRFC7250 handshakes with unauthenticated servers don't abort as expected7.4 High
olm-syscrates.ioolm-sys: wrapped library unmaintained, potentially vulnerableNo score- ni flexlogger, systemlink, systemlink server +2 moreNI SystemLink Server Ships Out of Date Redis Version7.8 High
silverstripe/frameworkPackagistSilverstripe uses TinyMCE which allows svg files linked in object tags5.3 MediumfionaPyPIFiona affected by CVE-2023-45853 related to MiniZip madler-zlib9.3 Critical- johnson controls tyco illustra flex4 dualsensor cameras, tyco illustra flex4 fixed & ptz cameras, tyco illustra pro4 fixed cameras +8 more +10 moreTYCO Illustra Pro Gen 4 - JQuery version7.0 High
- mitmproxy pdocpdoc embeds link to malicious CDN if math mode is enabled0.0 None
- netgear prosafe network management system, prosafe network management software 300 +1 moreNETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability8.8 High
github.com/traefik/traefikGo,github.com/traefik/traefik/v2Go,github.com/traefik/traefik/v3Go +2 moreTraefik vulnerable to GO issue allowing malformed DNS message to cause infinite loop5.3 Mediumpimcore/pimcorePackagistPimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-298816.1 Medium- microsoft azure sdk, azure software development kit +1 moreAzure SDK Spoofing Vulnerability7.5 High
com.linecorp.centraldogma:centraldogma-server-auth-samlMavenSAML authentication bypass due to missing validation on unsigned SAML messages9.1 Critical- intumit smartrobotIntumit inc. SmartRobot - Remote Code Execution9.8 Critical
- gitlab, hashicorp consul +1 moreDependency on Vulnerable Third-Party Component in GitLab5.9 Medium
- libtom libtommath, fedoraproject fedora +1 moreInteger Overflow vulnerability in mp_grow in libtom libtommath before commit...9.8 Critical
ntpdcrates.iontpd has Dependency on Vulnerable Third-Party Component2.6 Low- timlegge io::compress::brotliIO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library9.8 Critical
- facebook zstandardA race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could...8.1 High