3369 matches found
CVE-2026-62389
Removed by vendor...
CVE-2026-62314: Improper Access Control
Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP...
Malicious code in crypto-validate-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d8b69cab723043b20a628a6cd17f0e5cc64051004d9beb43d4b9ed58dbd9a0 index.js contains a self-invoking IIFE that, 37 seconds after the module is required, reads a base64 blob from test/fixtures/keypairs.dat a 53KB opaq...
EulerOS 2.0 SP10 : alsa-lib (EulerOS-SA-2026-2680)
According to the versions of the alsa-lib packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer contro...
Malicious code in eth-lib-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13895e2e8ee4aa9683c2fd6f0f873a38b19bbc5af207233e22c51668bc7dba41 Package [email protected] impersonates @ethereumjs/util / ethereumjs-util README, author list, repository URL, and source tree copied from the...
MAL-2026-10499 Malicious code in eth-lib-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13895e2e8ee4aa9683c2fd6f0f873a38b19bbc5af207233e22c51668bc7dba41 Package [email protected] impersonates @ethereumjs/util / ethereumjs-util README, author list, repository URL, and source tree copied from the...
CVE-2026-58228: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...
CVE-2026-15598: Improperly Controlled Modification of Object Prototype Attributes
A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The...
CVE-2026-55213: Memory Allocation with Excessive Size Value
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling...
CVE-2026-49213: Server-Side Request Forgery (SSRF)
TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHttpReqUrl.ts can be bypassed with the IPv6 unspecified address :: because validateIPAddress blocks local, metadata, and private ranges but does not block :: or its expanded form. ...
firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Graphics: ImageLib component...
Malicious code in txs-builder-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55bb13d76ebc74c36f68dd219079500d0bdb60e4bc07f8089eefbcde91bbdeac The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
shadcn-ui-lib (>=0.0.9, <=0.1.1) potentially affected by CVE-2026-55596 via @platejs/media (53.0.0)
@platejs/media NPM version 53.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @platejs/media and may be impacted: - shadcn-ui-lib =0.0.9, =0.1.1 Source cves: CVE-2026-55596 Source advisory: SNYK:JS-PLATEJSMEDIA-17901642...
Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tomcat11: tomcat11-11.0.24-0.1.hum1 noarch tomcat11-admin-webapps-11.0.24-0.1.hum1 noarch tomcat11-common-11.0.24-0.1.hum1 noarch tomcat11-docs-webapp-11.0.24-0.1.hum1 noarch...
CVE-2026-59887: Inefficient Algorithmic Complexity
linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test and .match can be invoked at every mailto: occurrence and scan the remaining input through srcemailname in lib/re.mjs, causing On^2 CPU consumption on crafted user text...
MAL-2026-7324 Malicious code in mwf-accounts-lib-native-call-language-preference (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @louisvuitton/configurator-common-lib (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10656 Malicious code in @pimy-b2cweb/frontend-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 52b7395e417c7c853087ef974cc074fc88ea814575ea3ff10ad627f90eb236ed The OpenSSF Package Analysis project identified '@pimy-b2cweb/frontend-lib' @ 99.99.99 npm as malicious. It is considered malicious because: - T...
Command Injection
Overview linuxfabrik-lib is a Python libraries used in various Linuxfabrik projects, including the 'Linuxfabrik Monitoring Plugins' project. Affected versions of this package are vulnerable to Command Injection via the shellexec function. An attacker can execute arbitrary commands with elevated...