CWE-1395: Dependency on Vulnerable Third-Party Component
The product has a dependency on a third-party component that contains one or more known vulnerabilities.
A kind of CWE-1357 Reliance on Insufficiently Trustworthy Component.
From the CWE List. © The MITRE Corporation.
Newest
github.com/centrifugal/centrifugoGo,github.com/centrifugal/centrifugo/v3Go,github.com/centrifugal/centrifugo/v4Go +2 more +4 moreCentrifugo v6.6.0 dependency vulnerabilitiesNo scoregogs.io/gogsGoGogs vulnerable to Stored XSS via Mermaid diagrams7.3 Highgithub.com/dunglas/frankenphpGoFrankenPHP has delayed propagation of security fixes in upstream base images9.8 Critical- open source opentofuOpenTofu before 1.11.4 Denial of Service via malicious zip2.3 Low
- jv harfbuzz::shaper, harfbuzz\ +1 moreHarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability7.5 High
- broadcom dx netops spectrumSpectrum outdated java library in class-path7.1 High
- iamb crypt::sodium::xs, crypt\ +1 moreCrypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium9.8 Critical
auth0/wordpressPackagistAuth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency6.8 Mediumauth0/symfonyPackagistAuth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK6.8 Mediumauth0/loginPackagistAuth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency6.8 Medium- rockwell automation micro820®, micro850®, micro870®Micro820®, Micro850®, Micro870® – Specialized Fuzzing Vulnerabilities7.1 High
nextnpm,@rootio/nextRoot +1 moreNext has a Denial of Service with Server Components - Incomplete Fix Follow-Up7.5 High@vitejs/plugin-rscnpmVite Plugin React has a Source Code Exposure Vulnerability in React Server Components5.3 Medium@vitejs/plugin-rscnpmVite Plugin React has a Denial of Service Vulnerability in React Server Components7.5 High- vercel next.jsNext.js: Unbounded postponed resume buffering can lead to DoS6.9 Medium
- vercel next.jsNext.js: null origin can bypass Server Actions CSRF checks5.3 Medium
- vercel next.jsNext.js: null origin can bypass dev HMR websocket CSRF checks2.3 Low
- vercel next, next.js +1 moreNext.js has Unbounded Memory Consumption via PPR Resume Endpoint5.9 Medium
- vercel next, next.js +1 moreNext.js Vulnerable to Denial of Service with Server Components5.9 Medium
- vercel next.jsNext.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications6.3 Medium
- vercel next.jsNext.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service6.3 Medium
- vercel next.jsNext.js: Unauthenticated Remote Code Execution on windows-hosted servers9.0 Critical
- vercel next.jsNext.js: Response Body Cache Confusion for Requests Containing Bodies6.0 Medium
- vercel next.jsNext.js: Denial of Service in App Router using Server Actions8.2 High
- vercel next.jsNext.js: Cache poisoning via collisions in React Server Component cache-busting3.7 Low
github.com/opentofu/opentofuGoOpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs5.9 Mediumonelogin/php-samlPackagistSAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-664759.3 Criticalgithub.com/filebrowser/filebrowserGo,github.com/filebrowser/filebrowser/v2Go +1 moreFile Browser has risk of HTTP Request/Response smuggling through vulnerable dependency9.1 Criticalgithub.com/opentofu/opentofuGoOpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses3.1 Low- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreBusybox 1.31.1 - Multiple Known Vulnerabilities10.0 Critical
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreVulnerable Components in Azure Access OS10.0 Critical
- weblateWeblate integration with Anubis can lead to Open Redirect via redir parameter2.1 Low
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Use of Outdated, End-Of-Life, and Vulnerable Third-Party Components9.3 Critical
- axxonsoft axxon one, axxonone c-werk +1 morePostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple Vulnerabilities9.3 Critical
- sap se netweaver as java (adobe document service)Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)3.4 Low
mitmproxyPyPImitmproxy binaries embed a vulnerable python-hyper/h2 dependency6.9 Medium- avid nexis e-series, nexis f-series, nexis pro+ +1 more +3 moreUnauthenticated Path Traversal affecting Avid NEXIS8.7 High
- etj archive::unzip::burstArchive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities9.8 Critical
- mik cryptxCryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode9.8 Critical
- atrodo net::dropbearNet::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow6.5 Medium
- mik cryptxPerl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow9.8 Critical
auth0/loginPackagistlaravel-auth0 SDK Deserialization of Untrusted Data vulnerability9.3 CriticalmulticastPyPImulticast in source builds from vulnerable setuptools dependency5.9 Medium- mongodb bson::xsBSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities9.8 Critical
- ether fcgiFCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library5.3 Medium
- vercel next.jsNext.js Race Condition to Cache Poisoning3.7 Low
vllmPyPICVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.09.8 Criticalgithub.com/traefik/traefikGo,github.com/traefik/traefik/v2Go,github.com/traefik/traefik/v3Go +2 moreTraefik affected by Go HTTP Request Smuggling Vulnerability9.1 CriticalvllmPyPIvLLM vulnerable to Denial of Service by abusing xgrammar cache6.5 Medium- go standard library net/http/internal, siemens sentron 7kt pac1261 data manager +1 moreRequest smuggling due to acceptance of invalid chunked data in net/http9.1 Critical
- Show moreLoading…