Malicious code in grpc-js-repository (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-2880 Malicious code in grpc-js-repository (npm)

--- -= Per source details. Do not edit below this line.=-...

WordPress JS Help Desk plugin <= 2.9.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin JS Help Desk versions = 2.9.2...

Next.js Authorization Bypass

Proof of concept exploit for a critical security vulnerability affecting Next.js, a popular React framework for building full-stack web applications. This flaw allows attackers to bypass authorization checks implemented in Next.js middleware, potentially granting unauthorized access to sensitive...

CVE-2025-2536

Cross-site scripting XSS vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's...

GHSA-F82V-JWR5-MFFW Authorization Bypass in Next.js Middleware

Impact It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. Patches For Next.js 15.x, this issue is fixed in 15.2.3 For Next.js 14.x, this issue is fixed in 14.2.25 For Next.js 13.x, this issue is fixed in 13.5.9 For Next.js...

CVE-2025-29927

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to ...

PT-2025-12398

Name of the Vulnerable Software and Affected Versions QuickJS versions up to 0.8.0 Description A stack-based buffer overflow issue was found in the JS GetRuntime function of the quickjs.c file in the qjs component. This issue can be exploited remotely, leading to a buffer overflow on the stack. T...

CVE-2025-2536

Cross-site scripting XSS vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's...

CVE-2025-2536

Cross-site scripting XSS vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's...

CVE-2025-2536

CVE-2025-2536 is an XSS vulnerability affecting Liferay Portal 7.4.3.82–7.4.3.128 and Liferay DXP releases up to 2024.Q3.0 (plus 2024.Q2.x, 2024.Q1.x, 2023 Q3/Q4 series). The issue resides in the Frontend JS module layout-taglib/liferay /index.js, where the toastData parameter can be used to inje...

CVE-2025-2536: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's...

Liferay Portal cross-site scripting vulnerabilities

Liferay Portal is a J2EE-based portal solution from the US company Liferay. The solution uses technologies such as EJB as well as JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, and so on. A cross-site scripting vulnerability exis...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.bowergithub.parallax:jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the addImage, html, and addSvgAsImage methods. An attacker can occupy excessive CPU by supplying a malicious...

JS Html Sanitizer allows XSS when used with contentEditable

Impact XSS vulnerability when the sanitizer is used with a contentEditable element to set the elements innerHTML to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, that runs AFTER sanitation. Patches Patched in version 2.0.3...

OESA-2025-1274 nodejs security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

MAL-2025-2433 Malicious code in winston-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9a7a8915407cab1038d31144af0dc322ca271f4ddcd30cbf0e040dccc9b7dca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2342 Malicious code in foundry-js-react-blueprint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 003370478f168f2d57cb08caf6214ba25adf57eaefa736fc7460dd4550ee09c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in auth0-langgraph-state-rag-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4726a148bd39bb68771231f6ed71f2edab6932f2f9468e69b5f659528ebb6d4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2298 Malicious code in auth0-langgraph-state-rag-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4726a148bd39bb68771231f6ed71f2edab6932f2f9468e69b5f659528ebb6d4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...