CVE-2026-106104

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR passed an unbounded User-Agent request header to getMatch in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated...

CVE-2026-106104 Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR passed an unbounded User-Agent request header to getMatch in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated...

CVE-2026-106104

The Quasar Framework (prior to version 2.23.3 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The Platform.parseSSR() function in ui/src/plugins/platform/Platform.js processes an unbounded User-Agent request header using browser-detection expressions that combine greedy captur...

Codify-TJNULL-OSCP-

Hack The Box — Writeup de Codify Procédure complète de test d'intrusion et writeup pour la machine Codify sur Hack The Box. 📌 Informations sur la machine Champ| Valeur ---|--- Nom| Codify OS| Linux Difficulté| Facile Concepts clés| vm2 RCE CVE-2023-30547, énumération de base SQLite, cassage de...

DEBIAN-CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-46395-haxcms-hmac-key-leak

CVE-2026-46395 - Divulgation de clé privée HAXcms Node.js via HMAC défaillant CWE-321 / CWE-200 Preuve de concept réservée aux tests de sécurité autorisés et à la recherche. La vulnérabilité décrite ici est corrigée dans la dernière version de HAXcms. Ce PoC est publié afin que les défenseurs et...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

EUVD-2026-93433

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

EUVD-2026-88626

pbkdf2 rehashes long passwords on every iteration, enabling denial of service...

RLSA-2026:75864 Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

Security Bulletin: Due to use of Nodejs Express.js, multiple vulnerabilities affect IBM Cloud Pak System[CVE-2024-43796, CVE-2024-43799, CVE-2024-43800]

Summary Multiple vulnerabilities in Send cross-site scripting XSS within the SendStream.redirect, serve-static built-in and response.redirect found in Node.js Express.js which is used by IBM Cloud Pak System. Vulnerabilities were addressed by IBM Cloud Pak System. Vulnerability Details...

CVE-2026-94545

CVE-2026-94545 Next.js next/og RCE non authentifiée ★ CVE-2026-94545 Next.js next/og injection SVG vers RCE native ★ https://github.com/user-attachments/assets/e297b40b-36ad-4a9a-b0c1-a64429bc0160 Vue d'ensemble next/og construit des images Open Graph en rendant du JSX vers un SVG avec Satori, pu...

CVE-2020-8277

CVE-2020-8277 À des fins éducatives uniquement. Exécution rapide clone this repository $ git clone https://github.com/masahiro331/CVE-2020-8277 run bind $ docker build -t bind-local ./bind Need TCP fallback $ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind use " v15.2.1" version If you...

CVE-2024-27983-nodejs-http2

Ce dépôt met en place un serveur Node.js HTTP2 vulnérable server-nossl.js basé sur CVE-2024-27983 qui exploite une vulnérabilité de continuation flood dans les serveurs HTTP2. Notes : server.js n'est pas vulnérable en raison de l'utilisation de certificats SSL. server-nossl.js est vulnérable à...

CVE-2026-5432-GraphQL-Batching-Alias-Confusion-SQL-Injection

7. CVE-2026-5432 – Injection SQL par confusion d'alias dans le batching GraphQL Aperçu Un résolveur GraphQL construit dynamiquement des requêtes SQL à partir des alias de champs. En utilisant le batching et les alias, un attaquant contourne une liste d'autorisation et injecte du SQL. Sévérité :...

RLSA-2026:75870 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via...

nodejs:22 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, module.nodejs-nodemon, nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...