pub vulnerabilities

Products

• archive 2
• agent_dart 1
• dio 1
• dio_http2_adapter 1
• http 1
• jose 1
• personnummer 1
• pubnub 1
• serverpod_auth_server 1
• serverpod_client 1
• shared_preferences_android 1

Latest pub CVEs

Newest publication first

1. CVE-2026-103030 Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

   Published 2026-10-13

   High·CVSS 7.5 EPSS 0.36%

   Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server...

2. CVE-2026-34240 jose vulnerable to untrusted JWK header key acceptance during signature verification

   Published 2026-03-31

   High·CVSS 7.5 EPSS 0.14%

   JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerability exists because ke...

3. GHSA-3hpf-ff72-j67p shared_preferences_android vulnerability

   Published 2024-12-06

   Low·CVSS 3.0

   Impact Due to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to...

4. CVE-2024-48915 Agent Dart missing certificate verification checks

   Published 2024-10-15

   High·CVSS 8.7 EPSS 0.37%

   Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in lib/agent/certificate.dart does not occur properly. During the delegation verification in the _checkDelegation function, the canister_r...

5. CVE-2024-29887 Serverpod client accepts any certificate

   Published 2024-03-27

   High·CVSS 7.4 EPSS 0.28%

   Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpod_client package. Making them susceptible to a man in the middle attack against encrypted traffic between...

6. CVE-2024-29886 Improved security for stored password hashes

   Published 2024-03-27

   Medium·CVSS 5.3 EPSS 0.26%

   Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6.

7. CVE-2023-26154 pubnub Insufficient Entropy vulnerability

   Published 2023-12-06

   Medium·CVSS 5.9 EPSS 0.96% PoC

   Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub...

8. CVE-2023-39137 Filename spoofing in archive

   Published 2023-08-30

   High·CVSS 7.8 EPSS 0.35% Framework module

   An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

9. CVE-2023-39139 Path traversal in Archive

   Published 2023-08-30

   High·CVSS 7.8 EPSS 0.37%

   An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.

10. CVE-2023-22963 personnummer/dart vulnerable to Improper Input Validation

    Published 2023-01-11

    Medium·CVSS 5.3 EPSS 0.53%

    The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expression.

11. CVE-2021-31402 dio vulnerable to CRLF injection with HTTP method string

    Published 2021-04-15

    High·CVSS 7.5 EPSS 1.2%

    The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669.

12. CVE-2020-35669 http before 0.13.3 vulnerable to header injection

    Published 2020-12-24

    Medium·CVSS 6.1 EPSS 2.2%

    An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.