keypairvuln

chiavi vulnerabili di keypair CVE-2021-41117 Le chiavi generate con versioni della libreria javascript keypair vulnerabili a CVE-2021-41117. A causa di bug nel generatore di numeri casuali, questa libreria genera alcune chiavi con maggiore probabilità. La probabilità di generare una delle chiavi ...

InfoLeak-Scanner

InfoLeak-Scanner Docker Führen Sie zuerst docker run --rm -p 8000:80 siwecos/infoleak-scanner aus. Öffnen Sie Ihren Browser und verwenden Sie den Scanner: http://localhost/?url= Install Holen Sie sich php5, curl und einen Webserver: root@kitploit: sudo apt-get install apache2 php5 php5-curl...

CVE-2026-16645

A flaw was found in PhotoSwipe - Responsive JavaScript Modal Image Gallery. This missing authorization vulnerability allows an attacker to perform forceful browsing, potentially leading to unauthorized access to sensitive information or resources. By exploiting this flaw, an attacker can bypass...

CVE-2026-2964-Lab

CVE‑2026‑2964 Lab – Prototype Pollution verso RCE Questo repository contiene un ambiente di laboratorio completo per CVE‑2026‑2964, una vulnerabilità di prototype pollution nella libreria web‑audio‑recorder‑js che può portare all'esecuzione remota di codice in condizioni specifiche. Il laboratori...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

CVE-2026-73414 Shescape: Shell injection via unescaped parentheses on Windows with CMD

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape and when applications use the escape or escapeAll APIs on Windows with shell set to cmd.exe, or with shell set to true when CMD is the default. An...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

nanoid: nanoid: Denial of Service via negative size input in non-secure module functions

A flaw was found in nanoid Nano ID, a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a...

CVE-2026-54272

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType classifies an address by matching it against a table of known IPv6...

CVE-2026-54272 ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType classifies an address by matching it against a table of known IPv6...

@3w5h/knowledge_query (1.0.30), @3w5h/utils (>=1.0.0, <=1.0.7) +649 more potentially affected by unknown CVE via sm-crypto (>=0.0.9, <=0.4.0)

sm-crypto NPM version =0.0.9, =1.0.0, =0.1.0, =1.0.13, =4.4.42, =0.0.2, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.7.8-alpha.2 - @ancademy/bespoke-group-share 2.5.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-SMCRYPTO-18601952...

DEBIAN-CVE-2026-48125

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application th...

CVE-2026-48069 @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in...

EUVD-2026-44409

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in...

MAL-2026-10169 Malicious code in paysafe-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1dc1a7847e47ee850fe8a4011ce83950962ab65cc742eb52919d13abe431e59 [email protected] impersonates a Paysafe payments SDK package name, description "Paysafe JavaScript SDK", and repository URL...

PT-2026-56497

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.6.5 protobufjs versions prior to 8.6.6 Description protobufjs compiles protobuf definitions into JavaScript functions. The software parses option names by advancing through schema tokens until an = token is reach...

GHSA-5375-PQ7M-F5R2 @grpc/grpc-js: A malformed request can cause a server crash

Impact An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. Patches The following version have fixes for this vulnerability: - 1.9.16 - 1.10.12 - 1.11.4 - 1.12.7 - 1.13.5 - 1.14.4 Workarounds There is no workaround...

Uncaught Exception

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Uncaught Exception via the handling of invalid incoming HTTP/2 stream initiation. An attacker can cause the server process to crash by sending a specially crafted malformed request. Remediation...

PT-2026-48691

Name of the Vulnerable Software and Affected Versions @grpc/grpc-js versions prior to 1.9.16 @grpc/grpc-js versions prior to 1.10.12 @grpc/grpc-js versions prior to 1.11.4 @grpc/grpc-js versions prior to 1.12.7 @grpc/grpc-js versions prior to 1.13.5 @grpc/grpc-js versions prior to 1.14.4...

EUVD-2026-36154

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "proto" member is an own enumerable property,...