keypairvuln

keypair vulnerable keys CVE-2021-41117 Keys generated with versions of the keypair javascript library vulnerable to CVE-2021-41117. Due to bugs in the random number generator this library will generate certain keys with higher likelyhood. The likelyhood of generating one of the keys in this repo...

InfoLeak-Scanner

InfoLeak-Scanner Docker First run docker run --rm -p 8000:80 siwecos/infoleak-scanner. Open your browser and use the scanner: http://localhost/?url= Install Get php5, curl and a webserver: sudo apt-get install apache2 php5 php5-curl Copy application into webserver: cp -R . /var/www/html/ What?...

CVE-2026-2964-Lab

CVE‑2026‑2964 Lab – 프로토타입 오염Prototype Pollution에서 RCE까지 이 저장소는 web‑audio‑recorder‑js 라이브러리의 프로토타입 오염 취약점인 CVE‑2026‑2964에 대한 완전한 실습 환경을 포함하며, 특정 조건에서 원격 코드 실행RCE으로 이어질 수 있습니다. 이 실습에는 다음이 포함됩니다: 공격 체인을 시연하는 취약한 서버index-vulnerable.js 적절한 살균sanitisation 및 허용 목록allowlist 검증을 구현한 수정된 서버index-fixed.js...

EUVD-2026-90979

KaTeX: Existing prototype pollution can bypass trust restrictions...

UBUNTU-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CLEANSTART-2026-QN85900 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the argo-workflows package. Picomatch is a glob matcher written JavaScript...

CLEANSTART-2026-FU60890 moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates

Security vulnerability affects the argo-workflows package. moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates...

CVE-2026-17495

A flaw was found in moment, a JavaScript library for handling dates. A remote attacker could exploit this vulnerability by providing a specially crafted input to the moment.locale function. This input, which is not a standard text string, can bypass security checks designed to prevent unauthorize...

CVE-2026-53496 ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

CVE-2026-83618

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:19+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp...

Malicious Package

Overview bella-serimuka92-kuki is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

UBUNTU-CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge...

CVE-2026-83615

A flaw was found in xmldom, a JavaScript library for parsing XML documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document. When processed, this document would cause the library to consume an excessive amount of memory, leading to the application...

DEBIAN-CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstructiontarget, data in lib/dom.js accepts an unvalidated target, while...

DEBIAN-CVE-2026-83611

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString can silently accept an end tag such as , close the element, and discard th...

CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...