125 matches found
CVE-2026-30240 Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerability in the PWA Progressive Web App ZIP processing endpoint POST /api/pwa/process-zip allows an authenticated user with builder privileges to read arbitrary...
CVE-2026-28355
Canarytokens help track activity and actions on a network. Versions prior to sha-7ff0e12 have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can inser...
CVE-2026-28355
Canarytokens help track activity and actions on a network. Versions prior to sha-7ff0e12 have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can inser...
CVE-2026-28355 "PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scripting
Canarytokens help track activity and actions on a network. Versions prior to sha-7ff0e12 have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can inser...
CVE-2026-28355
The CVE-2026-28355 entry covers a Self Cross-Site Scripting (XSS) vulnerability in the Canarytokens “PWA” Canarytoken. Affected component is the title field of the PWA token; versions prior to sha-7ff0e12 allow the creator to inject JavaScript that executes when the installation page is visited b...
CVE-2026-28355
Canarytokens help track activity and actions on a network. Versions prior to sha-7ff0e12 have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can inser...
CVE-2026-28355 "PWA" Canarytoken Vulnerable to Stored Self Cross-Site Scripting
Canarytokens help track activity and actions on a network. Versions prior to sha-7ff0e12 have a Self Cross-Site Scripting vulnerability in the "PWA" Canarytoken, whereby the Canarytoken's creator can attack themselves or someone they share the link with. The creator of a PWA Canarytoken can inser...
Canarytokens 跨站脚本漏洞
Canarytokens is a web activity tracking system open source by Thinkst Applied Research. Previous versions of Canarytokens had a cross-site scripting vulnerability. This vulnerability stemmed from improper handling of the title field in PWA Canarytoken, which could lead to cross-site scripting...
PT-2026-31510
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A flaw in policy enforcement within Progressive Web Apps PWAs in Google Chrome before version 147.0.7727.55 permitted a remote attacker, having already compromised the renderer process,...
EUVD-2018-17846
Malware in sbrugna...
EUVD-2021-34181
Malicious code in bioql PyPI...
EUVD-2021-34193
Malicious code in bioql PyPI...
EUVD-2022-3460
Malicious code in bioql PyPI...
EUVD-2024-51467
Malicious code in bioql PyPI...
EUVD-2024-42354
Malicious code in bioql PyPI...
Malicious code in vue-pwa (npm)
The package vue-pwa was found to contain malicious code...
MAL-2025-38671 Malicious code in vue-pwa (npm)
The package vue-pwa was found to contain malicious code...
@nodefony/monitoring-bundle (>=7.0.0-beta.3, <=7.0.0-beta.8), nodefony (>=7.0.0-beta.3, <=7.0.0-beta.8) potentially affected by CVE-2025-5897 via @vue/cli-plugin-pwa (5.0.8)
@vue/cli-plugin-pwa NPM version 5.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on @vue/cli-plugin-pwa and may be impacted: - @nodefony/monitoring-bundle =7.0.0-beta.3, =7.0.0-beta.3, =7.0.0-beta.8 Source cves: CVE-2025-5897 Source advisory:...
@vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability
A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficient regular expression...
Malicious code in next-pwa-template (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 598361c7d39c208feedabd0f7d7e0b666d50ad75fa8f2c7db2a64654e3c6a194 Any computer that has this package installed or running should be considered...