1112 matches found
GHSA-5M6Q-G25R-MVWX Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
Summary A Denial of Service DoS vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse function inherited from the bundled jsbn library. When modInverse is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachab...
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
Summary A Denial of Service DoS vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse function inherited from the bundled jsbn library. When modInverse is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachab...
CVE-2026-31848
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecospw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid...
PT-2026-28556
Name of the Vulnerable Software and Affected Versions node-forge versions prior to 1.4.0 Description A Denial of Service DoS issue exists in the node-forge library due to an infinite loop within the BigInteger.modInverse function, inherited from the bundled jsbn library. When modInverse is called...
PT-2026-28559
Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.0 Description Forge, a native implementation of Transport Layer Security in JavaScript, has an issue where the pki.verifyCertificateChain function does not properly enforce RFC 5280 basicConstraints requirements...
PT-2026-28558
Name of the Vulnerable Software and Affected Versions Forge also called node-forge versions prior to 1.4.0 Description Forge, a native implementation of Transport Layer Security in JavaScript, contains an issue in Ed25519 signature verification. Specifically, the verification process does not...
PT-2026-28557
Name of the Vulnerable Software and Affected Versions Forge versions prior to 1.4.0 Description Forge, a native implementation of Transport Layer Security in JavaScript, has a flaw in its RSASSA PKCS1 v1.5 signature verification process. This issue allows attackers to forge signatures for keys wi...
Use of Less Trusted Source
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Use of Less Trusted Source via the getRealIpAddr function. An attacker can bypass IP-based access controls, rate limiting, or forge audit log entries by sending...
CVE-2026-33330 FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback
FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control issue in FileRise's ONLYOFFICE integration allows an authenticated user with read-only access to obtain a signed save callbackUrl for a file and then directly forge the ONLYOFFICE save...
CVE-2026-33330 FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback
FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control issue in FileRise's ONLYOFFICE integration allows an authenticated user with read-only access to obtain a signed save callbackUrl for a file and then directly forge the ONLYOFFICE save...
Authentication Bypass
Authlib is vulnerable to Authentication Bypass. The vulnerability is due to fail-open behavior in the verifyhash function when processing unsupported or unknown algorithms, where hash validation incorrectly returns success, allowing attackers to forge ID Tokens and bypass integrity checks...
CVE-2026-32891
Anchorr (Discord bot) versions 1.4.1 and earlier contain a stored XSS vulnerability in the Jellyseerr user selector. An attacker can execute arbitrary JavaScript in the Anchorr admin’s browser session, calling the authenticated /api/config endpoint, which returns the full application configuratio...
Unsigned SAML LogoutRequest Acceptance in gosaml2
Summary The ValidateEncodedLogoutRequestPOST function in gosaml2 accepts completely unsigned SAML LogoutRequest messages even when SkipSignatureValidation is set to false. When validateElementSignature returns dsig.ErrMissingSignature, the code in decodelogoutrequest.go:60-62 silently falls throu...
Malicious code in @nxt-costco-com/forge-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 641344edeaa32a2f52f1274b17c2ba52ff688d8bbdc91484e29840bf7a9c5dae The package @nxt-costco-com/forge-icons was found to contain malicious code...
MAL-2026-1633 Malicious code in @nxt-costco-com/forge-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 641344edeaa32a2f52f1274b17c2ba52ff688d8bbdc91484e29840bf7a9c5dae The package @nxt-costco-com/forge-icons was found to contain malicious code...
Malicious code in @nxt-costco-com/forge-design-tokens (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86e4556dfaa2a30079bf31edd7c9a378deacc22b763f547a4b825d57945debef The package @nxt-costco-com/forge-design-tokens was found to contain malicious code...
MAL-2026-1632 Malicious code in @nxt-costco-com/forge-design-tokens (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86e4556dfaa2a30079bf31edd7c9a378deacc22b763f547a4b825d57945debef The package @nxt-costco-com/forge-design-tokens was found to contain malicious code...
Malicious code in @nxt-costco-com/forge-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a0e0f35823f6346841117866bac7213bfac75a55af137f2e63b2ac33dba9a54 The package @nxt-costco-com/forge-components was found to contain malicious code...
MAL-2026-1631 Malicious code in @nxt-costco-com/forge-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a0e0f35823f6346841117866bac7213bfac75a55af137f2e63b2ac33dba9a54 The package @nxt-costco-com/forge-components was found to contain malicious code...
