319619 matches found
@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +690 more potentially affected by CVE-2026-6733 via undici (>=7.0.0, <=7.27.2)
undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.26.4, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =0.5.1 - @anyauth/shared-deps 0.1.0 and more Source cves: CVE-2026-6733 Source advisory: SNYK:JS-UNDICI-17372752...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition in the HTTP/1.1 client when an attacker-controlled upstream server injects an unsolicited response onto an idle keep-alive...
@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +690 more potentially affected by CVE-2026-9678 via undici (>=7.0.0, <=7.27.2)
undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.26.4, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =0.5.1 - @anyauth/shared-deps 0.1.0 and more Source cves: CVE-2026-9678 Source advisory: SNYK:JS-UNDICI-17372697...
NPM: Multer vulnerable to Denial of Service via deeply nested field names
NPM: Multer vulnerable to Denial of Service via deeply nested field names vulnerability discovered by ? in WordPress Npm multer versions = 1.0.0, 2.2.0...
Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch
Because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrust...
Cisco Webex App Open Redirect Vulnerability
A vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticated, remote attacker to redirect users to a malicious webpage. Cisco has addressed this vulnerability in the Cisco Webex App, and no customer action is needed. This vulnerability existed due to...
Cisco Umbrella Virtual Appliance Privilege Escalation Vulnerability
A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied commands. An attacker with vmadmin privileges could exploit this...
CVE-2025-69157
Unauthenticated Local File Inclusion in Gamic = 1.15 versions...
CVE-2025-69111
Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...
Authorization Bypass Through User-Controlled Key
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the updateeventbyid process. An attacker can inject unauthorized events into another user's calendar by supplying a known calendarid as the destination...
@0xwork/connect (0.1.8), @a5c-ai/agent-platform (>=5.0.1-staging.19033314d476, <=5.0.1-staging.e195a4980892) +157 more potentially affected by CVE-2026-54327 via @earendil-works/pi-coding-agent (>=0.74.0, <=0.78.0)
@earendil-works/pi-coding-agent NPM version =0.74.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.6.10, =0.3.1, =2026.5.20-zh, =1.0.0-beta.10, =1.0.0-canary.9 -...
Laravel Framework: CRLF injection in default email rule
Summary A CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied...
EUVD-2025-210247
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCareer: from n/a through 7.3...
CVE-2026-49113
Subscriber Arbitrary Code Execution in Cornerstone 7.8.8 versions...
CVE-2026-42380
Unauthenticated PHP Object Injection in AI Lab 5.4.2 versions...
CVE-2026-27429
Unauthenticated PHP Object Injection in Nifty = 1.4.1 versions...
CVE-2025-69168
Unauthenticated Local File Inclusion in Spike = 1.2 versions...
EUVD-2026-37693
Unauthenticated PHP Object Injection in ShiftUp = 1.3 versions...
