CVE-2022-23487

js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than v0.38.0 of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of...

Exploit for Deserialization of Untrusted Data in Facebook React

🛠️ React2Shell - Simplifying React Exploitation Framework...

02.aula (1.0.0), 19json-validator (>=0.0.3, <=0.0.4) +3300 more potentially affected by CVE-2026-24001 via diff (>=5.0.0, <=5.2.0)

diff NPM version =5.0.0, =0.0.3, =0.0.1, =0.1.23, =0.1.4, =1.0.0, =1.0.7, =10.4.0, =9.0.0, =10.0.0, =10.0.0, =10.6.0 and more Source cves: CVE-2026-24001 Source advisory: SNYK:JS-DIFF-14917201...

Next.js Configuration File Detected

Next.js is a popular React framework for building web applications. By default, Next.js applications may include a configuration file named next.config.js, which contains various settings and options for the application. If this configuration file is accessible via the web server, it can expose...

io.undertow.js:undertow-js (>=1.0.0.alpha3, <=1.1.0.beta1), io.undertow.js:undertow-js-freemarker (1.1.0.beta1) +69 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.3.0.beta6)

io.undertow:undertow-core MAVEN version 1.3.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow.js:undertow-js =1.0.0.alpha3, =2.0.0.alpha13, =2.0.0.alpha13, =2.0.0.alpha13, =2.0.0.beta1 ...

CVE-2019-16772

The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting XSS. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of...

CVE-2025-14110

CVE-2025-14110 — WP Js List Pages Shortcodes (WordPress) A stored XSS vulnerability exists in the WP Js List Pages Shortcodes plugin via the class shortcode attribute. Affected versions are up to and including 1.21. Exploitation requires authenticated access at Contributor level or higher. Succes...

CVE-2024-14020 carboneio carbone Formatter input.js prototype pollution

A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js of the component Formatter Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes...

CVE-2025-14110: Improper Neutralization of Input During Web Page Generation

The WP Js List Pages Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and including, 1.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-1113

Malicious code in okta-auth-js npm...

Malicious Package

Overview okta-auth-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-91 Malicious code in okta-auth-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d2189b5df6091ef38c2619c0ed24b8814459b769da6b646901bb0d1987a440 The package okta-auth-js was found to contain malicious code. Source: ghsa-malware 65d7548ce9f766315a32892d8f9588740b8fab7cc50443598ea65e8e0ce9b2ab A...

Security Bulletin: Due to crypto.js in IBM WebSphere Application Server Liberty, IBM Operations Analytics - Log Analysis is affected by weaker than expected security

Summary crypto.js in IBM WebSphere Application Server Liberty is used by IBM Operations Analytics - Log Analysis is use to generate random numbers necessary for cryptographic operations. CVE-2020-36732. Vulnerability Details CVEID:CVE-2020-36732 DESCRIPTION: The crypto-js package before 3.2.1 for...

EUVD-2026-1133

Malicious code in redis-cookie-js npm...

Malicious code in redis-cookie-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c702113d5f2bf54eeb40b14947991242428d0d3fe07c09560ea2c10d953975f The package redis-cookie-js was found to contain malicious code. Source: ghsa-malware b7f1f65a70f0f5ed9257e64aa9d820766513adeb5a13fc8ac7ae11b9cf58d57...

Malicious Package

Overview redis-cookie-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-66 Malicious code in redis-cookie-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c702113d5f2bf54eeb40b14947991242428d0d3fe07c09560ea2c10d953975f The package redis-cookie-js was found to contain malicious code. Source: ghsa-malware b7f1f65a70f0f5ed9257e64aa9d820766513adeb5a13fc8ac7ae11b9cf58d57...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 - Tool React2Shell React2Shell Ultimate Sca...

PT-2026-28319

Name of the Vulnerable Software and Affected Versions Node.js versions 20.x through 25.x Description A flaw exists in the Node.js Permission Model's filesystem enforcement, specifically leaving the fs.realpathSync.native function without the necessary read permission checks. Comparable filesystem...

Unity Linux 20.1070e Security Update: nodejs (UTSA-2025-993344)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993344 advisory. A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by...