446 matches found
CVE-2026-2762
Integer overflow in the JavaScript: Standard Library component. This vulnerability affects Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...
CASL 安全漏洞
CASL is a JavaScript library developed by Serhii Stotskyi. Versions 2.4.0 to 6.7.4 of CASL contain security vulnerabilities, which stem from prototype pollution and may lead to logical errors or other attacks...
Fedora 43 : openqa / os-autoinst (2026-abd2d2d60c)
The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-abd2d2d60c advisory. This update provides new upstream snapshots of openQA and os-autoinst, with various fixes and enhancements. Please see upstream changelogs for details. They...
CVE-2026-24040 jsPDF has a Shared State Race Condition in addJS Plugin
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable text to store JavaScript content. When used in a concurrent environment e.g., a Node.js web server, this variable is shared across all requests. ...
CVE-2026-24040 jsPDF has a Shared State Race Condition in addJS Plugin
jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable text to store JavaScript content. When used in a concurrent environment e.g., a Node.js web server, this variable is shared across all requests. ...
Cross-site Scripting (XSS)
Overview @typebot.io/js is a Javascript library to display typebots on your website Affected versions of this package are vulnerable to Cross-site Scripting XSS via the imported bot preview. An attacker can access sensitive credentials belonging to other users by tricking a victim into previewing...
@aexol/opencode-tui (>=0.2.5, <=0.2.10), @alcyone-labs/arg-parser (>=2.11.0, <=2.13.4) +113 more potentially affected by CVE-2026-23736 via seroval (>=1.0.7, <=1.3.2)
seroval NPM version =1.0.7, =0.2.5, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =1.0.0, =1.0.0, =3.0.2 and more Source cves: CVE-2026-23736 Source advisory: SNYK:JS-SEROVAL-15054523...
CVE-2026-22775
A flaw was found in devalue, a JavaScript library used for serializing values. A remote attacker could exploit this vulnerability by providing specially crafted input to the devalue.parse function. This improper input validation, specifically during the ArrayBuffer hydration process, can cause th...
WordPress NextGEN Gallery plugin <= 3.59.11 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library vulnerability
Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library vulnerability discovered by Webbernaut in WordPress Plugin NextGEN Gallery versions = 3.59.11...
MAL-2025-192844 Malicious code in node-calculator-f483 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84a5e8d3f7bc17fcc1c20611e0b98235c4015291f1fe1af1f31497d604654663 The package node-calculator-f483 was found to contain malicious code...
31g-form-parser (>=1.0.1, <=1.0.126), @1024pix/storybook-ember (7.1.1) +205 more potentially affected by CVE-2025-68429 via @storybook/core-common (>=7.0.0, <=7.6.20)
@storybook/core-common NPM version =7.0.0, =1.0.1, =3.0.0, =0.1.0, =0.0.18, =2.0.5, =1.1.1, =0.0.1, =0.0.4, =0.38.0-rc.0, =0.38.0-rc.4 - @clds/menu-next 0.38.0 and more Source cves: CVE-2025-68429 Source advisory: SNYK:JS-STORYBOOKCORECOMMON-14470053...
CVE-2025-63700
Clerk-js 5.88.0 contains a security issue where an attacker can bypass the OAuth authentication flow by manipulating the OTP verification request. The publicly documented evidence across sources (Red Hat CVE notes, EUVD, GHSA advisory, and OSV/GHSA mirrors) consistently reference the OTP verifica...
@apollo/gateway (>=2.3.0-beta.2, <=2.9.4), @genesisx/graphql (>=3.0.0-beta.1, <=4.0.1) +8 more potentially affected by CVE-2025-64530 via @apollo/composition (>=2.3.0, <=2.9.4)
@apollo/composition NPM version =2.3.0, =2.3.0-beta.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.13.8-alpha-20230126151930-d229ec52b, =0.0.1, =9.2.0, =2.8.54, =0.0.0-preview-20230314213245, =1.3.3, =0.0.8, =1.0.48 Source cves: CVE-2025-64530 Source advisory: SNYK:JS-APOLLOCOMPOSITION-13961119...
MAL-2025-185505 Malicious code in apollo-nodejs-helmet-loglevel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f8efa0ddd24ff187a77bfbf2653e94f12a622525a7c6ac90cd8bb470c36f55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-70613 Malicious code in sick-yellow-lynx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc33917aaa28ae9034322a9f94e68c8b5fa17ba84578b0099d28982c8dcfac63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-12735
The expr-eval and expr-eval-fork npm packages are vulnerable to critical Remote Code Execution (RCE) due to insufficient input validation in the evaluate() function. An attacker can provide a crafted context object or use the MEMBER of a context object to inject malicious code that executes at th...
OPENSUSE-SU-2025:15679-1 libmozjs-128-0-128.14.0-2.1 on GA media
These are all security issues fixed in the libmozjs-128-0-128.14.0-2.1 package on the GA media of openSUSE Tumbleweed...
EUVD-2015-7877
Malware in sbrugna...