23 matches found
ROOT-APP-NPM-CVE-2026-12590 CVE-2026-12590 in body-parser - Patched by Root
Root has patched CVE-2026-12590 in the body-parser package for Root:npm. Multiple fixed versions available...
CLEANSTART-2026-PY70964 Security fixes in sqlpad 7.5.7-r4
Package sqlpad version 7.5.7-r4 fixes 2 vulnerabilities: ghsa-v422-hmwv-36x6, CVE-2026-12590...
CVE-2026-12590 vulnerabilities
Vulnerabilities for packages: code-server, json-server, kubeflow-pipelines, kubeflow-centraldashboard, argo-workflows, langfuse, tileserver-gl, jupyter-base-notebook, sqlpad...
CVE-2026-12590 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, thingsboard-fips, arangodb, kibana, sqlpad, gitlab-rails-ce, wazuh-dashboard-fips, unleash-proxy, tileserver-gl, commercial-gitlab-rails-ee, pelias-api, redisinsight, langfuse, jupyter-base-notebook, opensearch-dashboards, tileserver-gl-fips,...
01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18885 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)
body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.0.28, =0.0.36 and more Source cves: CVE-2026-12590 Source advisory: GHSA-V422-HMWV-36X6...
SUSE CVE-2026-12590
Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as thei...
@activepieces/piece-ai (>=0.3.1, <=0.3.4), @appium/base-driver (>=10.0.0-rc.2, <=10.7.1) +175 more potentially affected by CVE-2026-12590 via body-parser (>=2.0.0-beta.1, <=2.2.2)
body-parser NPM version =2.0.0-beta.1, =0.3.1, =10.0.0-rc.2, =3.2.0, =4.2.0, =2.0.32, =1.4.0, =1.1.1, =1.0.15, =1.0.15, =1.0.1-beta.1, =9.1.1-ruixiang.1, =9.0.0, =3.0.10, =3.8.8, =1.114.0, =3.20.1 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...
01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18885 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)
body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.0.28, =0.0.36 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...
CVE-2026-12590
creationtimestamp| type| source ---|---|--- 2026-07-09 10:29:15+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mq7gg7lj5s2d 2026-07-10 05:29:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg5qdepx2e 2026-07-21 05:31:05+00:00| seen|...
CVE-2026-12590
Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as thei...
CVE-2026-12590 body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as thei...
CVE-2026-12590
Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as thei...
CVE-2026-12590
Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as thei...
CVE-2025-12590
creationtimestamp| type| source ---|---|--- 2025-11-11 05:33:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5dfyesz7s2q...
WordPress YSlider plugin <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability
Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin YSlider versions = 1.1...
CVE-2024-12590
The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...
CVE-2024-12590
The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...
CVE-2024-12590
creationtimestamp| type| source ---|---|--- 2025-01-07 03:37:50+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/296 2025-01-07 04:13:18+00:00| seen| https://infosec.exchange/users/cve/statuses/113785123354135342 2025-01-07 04:16:02+00:00| seen|...
Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2023-12590)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12590 advisory. 5.4.17-2136.321.4.el7 - tick/common: Align tick period during schedtimer setup Thomas Gleixner Orabug: 35520079 - net/rds: Fix endless rdssendxmit loo...