266077 matches found
CVE-2026-101880 OpenClaw Windows Node before 2026.7.1 Authorization Bypass
OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agents can bypass approval rules by placing...
CVE-2026-101879 OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot,...
NPM: DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
NPM: DOMPurify: INPLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.13, = 3.4.15...
GHSA-M8M8-QJ5V-23W3 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Summary Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection...
NPM: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
NPM: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection vulnerability discovered by ? in WordPress Npm axios versions = 1.15.2, 1.20.0...
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Summary Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection...
Malicious Package
Overview epic-webpack-node-externals is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
CVE-2026-102984
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...
Exploit for CVE-2026-94545
CVE-2026-94545: Next.js next/og Unauthenticated Remote Code...
CVE-2026-102984 Astro: Malformed port in the Host header can crash the Node adapter
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...
CVE-2026-102984
The Astro web framework, specifically the @astrojs/node adapter prior to version 11.1.3 , is vulnerable to a crash caused by a malformed port in the Host header . When the adapter builds a request URL, a malformed port creates an invalid URL; the subsequent recovery path reuses this host, trigger...
CVE-2026-102984
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...
@chocolatey-software/astro (2.10.0), @hyperscale-it/agent-workflow (0.1.0) +1 more potentially affected by CVE-2026-102984 via @astrojs/node (>=11.0.2, <=11.0.3)
@astrojs/node NPM version =11.0.2, =0.1.0, =0.2.2 Source cves: CVE-2026-102984 Source advisory: MEND:CVE-2026-102984...
EUVD-2026-89970
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...
CVE-2026-102984 Astro: Malformed port in the Host header can crash the Node adapter
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...
CVE-2026-102984 Astro: Malformed port in the Host header can crash the Node adapter
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...
CVE-2026-92873
Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node...
CVE-2026-92873
The Pgpool-II software contains an incorrect implementation of an authentication algorithm . This vulnerability may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node . No specific exploitation details or remediation steps are provided in the documents.