js-jobs

js-jobs JS Job Manager 1.1.9 - Unauthenticated Arbitrary Plugin Installation/Activation Description The jsjobsajax AJAX action of the plugin available to both authenticated and unauthenticated users does not have proper authorisation and CSRF checks, in particular when using the...

jsleak

jsleak jsleak is a tool to identify sensitive data in JS files through regex patterns. Although it's built for this, you can use it to identify anything as long as you have a regex pattern for it. How to install Directly: root@kitploit: your package manager install pkg-config libpcre++-dev go get...

CVE-2026-93751: Improper Handling of Unicode Encoding

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-93749: Improper Validation of Specified Quantity in Input

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...

CVE-2026-93690: Loop with Unreachable Exit Condition

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

CVE-2026-87915: Improper Neutralization of Input During Web Page Generation

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...

CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

CVE-2026-86038

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:04+00:00| published-proof-of-concept| https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp...

Important: Red Hat Security Advisory: Kiali 2.17.14 for Red Hat OpenShift Service Mesh 3.2

Kiali 2.17.14 for Red Hat OpenShift Service Mesh 3.2 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Kiali 2.11.17 for Red Hat OpenShift Service Mesh 3.1

Kiali 2.11.17 for Red Hat OpenShift Service Mesh 3.1 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Important: Red Hat Security Advisory: Kiali 2.4.23 for Red Hat OpenShift Service Mesh 3.0

Kiali 2.4.23 for Red Hat OpenShift Service Mesh 3.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

ROOT-APP-NPM-GHSA-5P4M-2WFM-XMQJ GHSA-5p4m-2wfm-xmqj in js-yaml - Patched by Root

Root has patched GHSA-5p4m-2wfm-xmqj in the js-yaml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-84375 CVE-2026-84375 in js-yaml - Patched by Root

Root has patched CVE-2026-84375 in the js-yaml package for Root:npm. Multiple fixed versions available...

CVE-2026-2964-Lab

CVE‑2026‑2964 Lab – Prototype Pollution a RCE Este repositorio contiene un entorno de laboratorio completo para CVE‑2026‑2964, una vulnerabilidad de prototype pollution en la librería web‑audio‑recorder‑js que puede conducir a la ejecución remota de código bajo condiciones específicas. El...

ROOT-APP-NPM-CVE-2026-73231 CVE-2026-73231 in @faker-js/faker - Patched by Root

Root has patched CVE-2026-73231 in the @faker-js/faker package for Root:npm. Multiple fixed versions available...

CVE-2026-19619 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

CVE-2026-92234 QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the...

CVE-2026-65831 ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/database with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization...

CVE-2026-65831: Improper Privilege Management

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/database with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization...