256496 matches found
CVE-2026-41672 xmldom: XML node injection through unvalidated comment serialization
xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or...
SUSE CVE-2025-71290
In the Linux kernel, the following vulnerability has been resolved: misc: tifpc202: fix a potential memory leak in probe function Use foreachchildofnodescoped to simplify the code and ensure the device node reference is automatically released when the loop scope ends...
GHSA-V2V4-37R5-5V8G vulnerabilities
Vulnerabilities for packages: kubeflow-katib, npm, sqlpad, kubeflow-pipelines, opensearch-dashboards, prism, pulumi, tileserver-gl, renovate, lerna, saf, code-server, langfuse...
CVE-2026-42338 vulnerabilities
Vulnerabilities for packages: kubeflow-katib, npm, sqlpad, kubeflow-pipelines, opensearch-dashboards, prism, pulumi, tileserver-gl, renovate, lerna, saf, code-server, langfuse...
GHSA-V2V4-37R5-5V8G vulnerabilities
Vulnerabilities for packages: code-server, pulumi, langfuse, kubeflow-katib, sqlpad, wazuh-dashboard, opensearch-dashboards, actions-runner, drupal, lerna, kibana, tileserver-gl, librechat, prism, langfuse-fips, gemini-cli, kubeflow-pipelines, npm, wazuh-dashboard-fips, graalvm, tileserver-gl-fip...
CVE-2026-42338 vulnerabilities
Vulnerabilities for packages: code-server, pulumi, langfuse, kubeflow-katib, sqlpad, wazuh-dashboard, opensearch-dashboards, actions-runner, drupal, lerna, kibana, tileserver-gl, librechat, prism, langfuse-fips, gemini-cli, kubeflow-pipelines, npm, wazuh-dashboard-fips, graalvm, tileserver-gl-fip...
OpenSearch has ineffective TLS certificate hostname verification
Description A regression was introduced in OpenSearch 2.18.0 that caused the plugins.security.ssl.transport.enforcehostnameverification setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecting node's TLS certificate matched the hostname...
PT-2026-41509
Name of the Vulnerable Software and Affected Versions OpenSearch versions 2.18.0 through 2.19.3 OpenSearch versions 3.0.0 through 3.2.x Description A regression caused the plugins.security.ssl.transport.enforce hostname verification setting to be ineffective. When enabled, the system failed to...
PT-2026-38438
NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js...
CVE-2025-63705
The CVE-2025-63705 entry concerns the NPM package node-ts-ocr version 1.0.15, with a reported OS Command Injection via the invokeImageOcr function in src/index.js. The vulnerability is described as enabling arbitrary command execution with a network attack vector, as indicated by the CVSS 3.1 met...
NocoBase 2.0.27 - VM Sandbox Escape
Exploit Title: NocoBase 2.0.27 - VM Sandbox Escape Date: 2026-03-26 Exploit Author: Onurcan Genç Vendor Homepage: https://www.nocobase.com/ Software Link: https://github.com/nocobase/nocobase Version: -u -P --cmd "id" python3 exploit.py -t TARGE...
XMLDOM 安全漏洞
XMLDOM is a JavaScript implementation of the W3C DOM for Node developed by jindw. Versions of XMLDOM prior to 0.9.10, 0.8.13, and xmldom 0.6.0 and earlier contained security vulnerabilities. These vulnerabilities stemmed from improper validation or neutralization of the PI end sequence when...
next-npm-version 1.0.1 安全漏洞
next-npm-version is a tool developed by Aric, a personal developer, for retrieving npm package versions. The version 1.0.1 of next-npm-version contains a security vulnerability, which stems from command injection...
CVE-2025-63705
NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js...
MAL-2026-3643 Malicious code in camelotlabs-utils (npm)
Five packages camelotlabs-sdk, camelotlabs-core, camelotlabs-config, camelotlabs-worker, and camelotlabs-utils were published to the public npm registry at version 99.0.0 by the actor madman0619 as a dependency confusion attack targeting the internal npm packages of Camelot Labs. The inflated...
CVE-2025-63705
NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js...
Node Typescript OCR 安全漏洞
Node Typescript OCR is a command-line PDF and image OCR processing tool developed by Nicolas Pearson. Version 1.0.15 of Node Typescript OCR contains a security vulnerability, which stems from the invokeImageOcr function in src/index.js, where OS command injection occurs...
PT-2026-38453
Name of the Vulnerable Software and Affected Versions query-parser-string version 1.0.0 Description The software is subject to Prototype Pollution, a condition where an attacker can manipulate the prototype of an object to alter the behavior of the application. This occurs because the package fai...
