438 matches found
Cross-site Scripting (XSS)
Overview @typebot.io/js is a Javascript library to display typebots on your website Affected versions of this package are vulnerable to Cross-site Scripting XSS via the imported bot preview. An attacker can access sensitive credentials belonging to other users by tricking a victim into previewing...
@aexol/opencode-tui (>=0.2.5, <=0.2.10), @alcyone-labs/arg-parser (>=2.11.0, <=2.13.4) +113 more potentially affected by CVE-2026-23736 via seroval (>=1.0.7, <=1.3.2)
seroval NPM version =1.0.7, =0.2.5, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =1.0.0, =1.0.0, =3.0.2 and more Source cves: CVE-2026-23736 Source advisory: SNYK:JS-SEROVAL-15054523...
CVE-2026-22775
A flaw was found in devalue, a JavaScript library used for serializing values. A remote attacker could exploit this vulnerability by providing specially crafted input to the devalue.parse function. This improper input validation, specifically during the ArrayBuffer hydration process, can cause th...
WordPress NextGEN Gallery plugin <= 3.59.11 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library vulnerability
Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin NextGEN Gallery versions = 3.59.11...
MAL-2025-192844 Malicious code in node-calculator-f483 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84a5e8d3f7bc17fcc1c20611e0b98235c4015291f1fe1af1f31497d604654663 The package node-calculator-f483 was found to contain malicious code...
31g-form-parser (>=1.0.1, <=1.0.126), @1024pix/storybook-ember (7.1.1) +205 more potentially affected by CVE-2025-68429 via @storybook/core-common (>=7.0.0, <=7.6.20)
@storybook/core-common NPM version =7.0.0, =1.0.1, =3.0.0, =0.1.0, =0.0.18, =2.0.5, =1.1.1, =0.0.1, =0.0.4, =0.38.0-rc.0, =0.38.0-rc.4 - @clds/menu-next 0.38.0 and more Source cves: CVE-2025-68429 Source advisory: SNYK:JS-STORYBOOKCORECOMMON-14470053...
CVE-2025-63700
Clerk-js 5.88.0 contains a security issue where an attacker can bypass the OAuth authentication flow by manipulating the OTP verification request. The publicly documented evidence across sources (Red Hat CVE notes, EUVD, GHSA advisory, and OSV/GHSA mirrors) consistently reference the OTP verifica...
@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0, <=2.9.4)
@apollo/composition NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: SNYK:JS-APOLLOCOMPOSITION-13961119...
MAL-2025-185505 Malicious code in apollo-nodejs-helmet-loglevel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f8efa0ddd24ff187a77bfbf2653e94f12a622525a7c6ac90cd8bb470c36f55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-70613 Malicious code in sick-yellow-lynx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc33917aaa28ae9034322a9f94e68c8b5fa17ba84578b0099d28982c8dcfac63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-12735
The expr-eval and expr-eval-fork npm packages are vulnerable to critical Remote Code Execution (RCE) due to insufficient input validation in the evaluate() function. An attacker can provide a crafted context object or use the MEMBER of a context object to inject malicious code that executes at th...
OPENSUSE-SU-2025:15679-1 libmozjs-128-0-128.14.0-2.1 on GA media
These are all security issues fixed in the libmozjs-128-0-128.14.0-2.1 package on the GA media of openSUSE Tumbleweed...
EUVD-2020-1476
Malware in sbrugna...
EUVD-2021-2148
Malware in sbrugna...
EUVD-2014-1632
Malware in sbrugna...
EUVD-2015-7877
Malware in sbrugna...
EUVD-2017-1246
Malware in sbrugna...
EUVD-2025-29227
Malicious code in bioql PyPI...