8860 matches found
Security Bulletin: Multiple vulnerabilities in IBM Planning Analytics Advanced Certified Containers
Summary Multiple vulnerabilities were addressed in IBM Planning Analytics Advanced Certified Containers 3.1.2. Vulnerability Details CVEID:CVE-2025-23166 DESCRIPTION: The C++ method SignTraits::DeriveBits may incorrectly call ThrowException based on user-supplied inputs when executing in a...
GHSA-8WJ8-CFXR-9374 AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance
Description of Vulnerability: An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rdssuperuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service RDS...
EUVD-2025-112795
Malicious code in hermes-gacrux-meissa-cordelia npm...
EUVD-2025-113242
Malicious code in geckodriver-kastra-public-deneb npm...
EUVD-2025-69814
Malicious code in influentiallocustz3n npm...
EUVD-2025-71008
Malicious code in colouredcrayfishz3n npm...
Astra Linux – Vulnerability in Node.js
A security flaw in Node.js allows for bypassing network import restrictions. By embedding non-network-related imports within data URLs, attackers can execute arbitrary code, compromising system security. This vulnerability has been confirmed on various platforms. It can be mitigated by prohibitin...
@142vip/midway (>=0.1.6-alpha.9, <=0.1.6-alpha.12), @142vip/nest-starter (>=0.0.1-alpha.1, <=0.0.1-alpha.13) +2728 more potentially affected by CVE-2025-60542 via typeorm (>=0.0.2-alpha.43, <=0.3.25)
typeorm NPM version =0.0.2-alpha.43, =0.1.6-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.1, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =1.0.14 - @actonate/mirkwood 0.10.1 and more Source cves: CVE-2025-60542 Source advisory: SNYK:JS-TYPEORM-13746469...
Security Bulletin: IBM Maximo Application Suite - Manage Component uses multer-1.4.5-lts.2.tgz which is vulnerable to CVE-2025-47935.
Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses multer-1.4.5-lts.2.tgz which is vulnerable to CVE-2025-47935. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-47935 DESCRIPTION: Multer is a node.js...
@angular-devkit/build-angular (>=20.2.0-next.3, <=21.0.0-next.8), @angular/build (>=20.2.0-next.3, <=21.0.0-next.8) +73 more potentially affected by CVE-2025-62522 via vite (>=7.1.0, <=7.1.10)
vite NPM version =7.1.0, =20.2.0-next.3, =20.2.0-next.3, =2.1.2-alpha.0, =1.0.0-alpha.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =0.11.0-alpha.5, =1.0.0-alpha.2 and more Source cves: CVE-2025-62522 Source advisory: SNYK:JS-VITE-13644406...
test-reflected-xss-nodejs
It is an offensive tool for web application security testing. Th...
Node.js: fs.futimes() Bypasses Read-Only Permission Model
A flaw in Node.js's permission model was discovered that allowed a file's access and modification timestamps to be changed via futimes even when the process had only read permissions. Unlike utimes, futimes did not apply the expected write-permission checks, which meant file metadata could be...
@1771technologies/oneplay (>=0.0.1, <=0.0.6), @a11ywatch/pagemind (>=0.9.31, <=0.9.34) +513 more potentially affected by CVE-2025-59288 via playwright (>=1.0.2, <=1.55.0-beta-1758616447000)
playwright NPM version =1.0.2, =0.0.1, =0.9.31, =0.1.8, =0.0.18-patch.0, =0.0.33, =0.0.1, =0.1.1, =0.1.1, =0.0.10-a, =0.0.1, =0.1.466, =0.32.2, =2.15.0, =0.3.0, =0.7.3 and more Source cves: CVE-2025-59288 Source advisory: OSV:GHSA-7MVR-C777-76HP...
Stealit Malware Abuses Node.js Single Executable Feature via Game and VPN Installers
Cybersecurity researchers have disclosed details of an active malware campaign called Stealit that has leveraged Node.js' Single Executable Application SEA feature as a way to distribute its payloads. According to Fortinet FortiGuard Labs, select iterations have also employed the open-source...
@iflow-mcp/theycallmeholla-schema-org-mcp (0.1.0), @wonderwhy-er/desktop-commander (>=0.2.29-alpha.3, <=0.2.29-alpha.4) +2 more potentially affected by CVE-2025-11490 via @wonderwhy-er/desktop-commander (>=0.1.39, <=0.2.47)
@wonderwhy-er/desktop-commander NPM version =0.1.39, =0.2.29-alpha.3, =1.0.0, =1.0.1 - familiar-mcp 0.1.0 Source cves: CVE-2025-11490 Source advisory: SNYK:JS-WONDERWHYERDESKTOPCOMMANDER-13535095...
FlowiseAI/Flosise has File Upload vulnerability
Summary A file upload vulnerability in FlowiseAI allows authenticated users to upload arbitrary files without proper validation. This enables attackers to persistently store malicious Node.js web shells on the server, potentially leading to Remote Code Execution RCE. Details The system fails to...
EUVD-2018-0556
Malware in sbrugna...
EUVD-2020-5783
Malware in sbrugna...