203061 matches found
Malicious code in thedata (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595 The package's main entry index.js re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's...
GHSA-4MRV-5P47-P938
creationtimestamp| type| source ---|---|--- 2026-07-30 17:31:24+00:00| seen| https://gist.github.com/alon710/f9483ca84f65ab9c98c78744c876def1...
DEBIAN-CVE-2026-12932
A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service memory exhaustion via a flood of crafted packets...
SUSE CVE-2026-17847
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...
SUSE CVE-2026-17953
Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...
SUSE CVE-2026-18019
Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...
SUSE CVE-2026-28732
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 Fail to enforce slash command trigger-word uniqueness during command updates which allows an authenticated team member with Manage Own Slash Commands permission to hijack and impersonate existing system or custom slash...
GHSA-4RCQ-JV2F-898J
creationtimestamp| type| source ---|---|--- 2026-07-30 16:49:58+00:00| seen| https://gist.github.com/tu-trinh-scale/6952882fc494bc673397ec58f04a6e92 2026-07-30 19:33:45+00:00| seen| https://gist.github.com/tu-trinh-scale/cdec105f804c8b4962d64774b7f2237d 2026-07-30 19:34:08+00:00| seen|...
GHSA-VW27-FWJF-5QXM
creationtimestamp| type| source ---|---|--- 2026-07-30 16:49:48+00:00| seen| https://gist.github.com/tu-trinh-scale/6952882fc494bc673397ec58f04a6e92 2026-07-30 19:33:36+00:00| seen| https://gist.github.com/tu-trinh-scale/cdec105f804c8b4962d64774b7f2237d 2026-07-30 19:33:48+00:00| seen|...
SUSE CVE-2026-50149
Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an HTTPProxy is configured with incompatible combination of both .spec.virtualhost.tls.enableFallbackCertificate: true and .spec.virtualhost.jwtProviders, Contour does not reject the configuratio...
SUSE CVE-2026-53487
Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...
SUSE CVE-2026-56443
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories - residual after CVE-2026-25714 / PR 37118...
CVE-2026-67438
creationtimestamp| type| source ---|---|--- 2026-07-30 16:35:33+00:00| published-proof-of-concept| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-xc5w-4v5w-7x65 2026-07-31 08:32:20+00:00| seen| https://gist.github.com/alon710/006ebdb624799640fa8e05feb88f3b11...
CVE-2026-67427
creationtimestamp| type| source ---|---|--- 2026-07-30 16:35:12+00:00| published-proof-of-concept| https://github.com/flytohub/flyto-core/security/advisories/GHSA-hr7p-wg7r-hg9m 2026-07-30 23:32:08+00:00| seen| https://gist.github.com/alon710/937397e52a8e0970b2abb603a8f2aff3 2026-07-31...
CVE-2026-67425
creationtimestamp| type| source ---|---|--- 2026-07-30 16:35:10+00:00| published-proof-of-concept| https://github.com/flytohub/flyto-core/security/advisories/GHSA-qq9q-xgm3-xv9g 2026-07-30 22:32:21+00:00| seen| https://gist.github.com/alon710/118a4cdb35451ca1b82ac84f2659aa47 2026-07-31...
CVE-2026-54522
CVE-2026-54522 affects MessagePack for Ruby prior to 1.8.2, where MessagePack::Buffer#clear can leave internal rmem pointers stale after a chunk return, enabling a subsequent Buffer#write to alias the freed page and potentially disclose or corrupt cross-buffer data. Root cause: stale rmem_last/rm...
GHSA-PGWH-4JJ4-QM8V
creationtimestamp| type| source ---|---|--- 2026-07-30 16:30:59+00:00| seen| https://gist.github.com/alon710/abbfb678b2ea15b959183e89124a0f42...
CVE-2026-59326
creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:18+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...