Snyk
16 CVEs across 31 Snyk products. Browse Snyk vulnerabilities, severities, and proof-of-concept exploits.
Snyk products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6624 | High | 7.2 | 2025-06-26 | Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Re… |
CVE-2024-21571 | High | 8.1 | 2024-12-06 | Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to execute arbitrary code… |
CVE-2024-48964 | High | 7.5 | 2024-10-23 | The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test… |
CVE-2024-48963 | High | 7.5 | 2024-10-23 | The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is… |
CVE-2023-1767 | Medium | 4.3 | 2023-04-20 | The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the conten… |
CVE-2023-1065 | Medium | 6.5 | 2023-02-28 | This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relev… |
CVE-2022-24441 | Medium | 5.8 | 2022-11-30 | The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can… |
CVE-2022-22984 | Medium | 5.0 | 2022-11-30 | The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plu… |
CVE-2022-40764 | High | 7.8 | 2022-10-03 | Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common prac… |
CVE-2020-7649 | Medium | 4.9 | 2022-07-25 | This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal. |
CVE-2019-10797 | Medium | 6.5 | 2020-02-19 | Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled. |
CVE-2019-10791 | Critical | 9.8 | 2020-02-18 | promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by user… |
CVE-2019-10795 | Medium | 6.3 | 2020-02-18 | undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a… |
CVE-2019-10794 | Medium | 6.3 | 2020-02-18 | All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototyp… |
CVE-2019-10793 | Medium | 6.3 | 2020-02-18 | dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a… |
CVE-2019-10792 | Medium | 6.3 | 2020-02-18 | bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using… |
CVE-2019-10781 | Critical | 9.8 | 2020-01-22 | In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspecto… |
CVE-2019-10760 | Critical | 9.9 | 2019-10-15 | safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code. |
CVE-2019-10759 | Critical | 9.9 | 2019-10-15 | safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code. |
CVE-2019-3800 | Medium | 6.3 | 2019-08-05 | CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-cred… |
CVE-2019-10744 | Critical | 9.1 | 2019-07-26 | Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of… |