1309 matches found
DRUPAL-CONTRIB-2026-225
The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engine runs eval to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about...
PT-2026-120899
The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engine runs eval to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about...
Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228
The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would need a role with permission to...
DRUPAL-CONTRIB-2026-203
The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands...
PT-2026-107756
The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacke...
Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204
The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacke...
Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203
The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands...
PT-2026-107755
The Inline Formatter Field module allows site builders to template and style entities with a field. This module does not properly protect against template injection when parsing, allowing users to render protected data or execute unsafe Twig commands...
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
Summary Attacker-controlled code can trigger a host-realm syntax error and read its stack through the vm2 bridge. Host-realm stack formatting bypasses the sandbox-side redaction, so the returned value exposes absolute paths from vm2, Node.js internals, and the embedding application. Default VM an...
CVE-2026-104714 Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...
CVE-2026-104714 Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...
CVE-2026-104714 Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...
[SECURITY] Fedora 45 Update: ruff-0.16.9-1.fc45
An extremely fast Python linter and code formatter, written in Rust. Ruff aims to be orders of magnitude faster than alternative tools while integrating more functionality behind a single, common interface. Ruff can be used to replace Flake8 plus dozens of plugins, Black, isort, pydocstyle,...
[SECURITY] Fedora 44 Update: ruff-0.16.9-1.fc44
An extremely fast Python linter and code formatter, written in Rust. Ruff aims to be orders of magnitude faster than alternative tools while integrating more functionality behind a single, common interface. Ruff can be used to replace Flake8 plus dozens of plugins, Black, isort, pydocstyle,...
Malicious code in simple-date-formatter-new-12 (npm)
Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The script uses curl to fetch an internal Baidu host...
Malicious code in simple-date-formatter-new-12 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...
MAL-2026-17229 Malicious code in simple-date-formatter-new-12 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...
Malicious Package
Overview simple-date-formatter-new-12 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
CVE-2026-91204
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...
CVE-2026-91204 Apache Roller: Stored javascript: URI in HTML comments
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...