630136 matches found
PT-2026-103534
Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description An OS Command Injection flaw exists where an authenticated administrator can upload a configuration package with insufficiently validated contents. Processing a crafted package allows the...
CVE-2026-102096: Improper Neutralization of Special Elements used in an OS Command
Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...
CVE-2026-92173: Undefined Security Weakness
Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the...
The vulnerability of the compatibility package for Microsoft Azure Entra ID lies in insufficient validation of requests on the server side, allowing attackers to escalate their privileges.
The vulnerability of the compatibility package for Microsoft Azure Entra ID is related to insufficient validation of requests at the server-side. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...
PT-2026-103605
Name of the Vulnerable Software and Affected Versions Meta Horizon OS versions prior to 66.0.0.733.524 Description OVRMediaService can be induced to send a privileged PendingIntent containing a com.oculus.horizon CallerIdentity to any application that registers for...
AlmaLinux 9.2 [TuxCare] Security Update: edk2-aarch64 / edk2-ovmf / edk2-tools / edk2-tools-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763716672)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763716672 advisory. - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IANA or IATA option in a DHCPv6...
CVE-2026-102830 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...
CVE-2026-102830
A vulnerability in JupyterLab (versions 3.0.0 through 4.5.11 and 4.6.4) and JupyterLite Core (0.8.3 and earlier) allows for the execution of arbitrary JavaScript. The root cause is a prefix-only regular-expression validation in the Plural-Forms header of certain third-party language packs, which ...
@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +2064 more potentially affected by CVE-2026-85008 via undici (>=7.0.0, <=7.29.0)
undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =1.0.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =1.0.0, =1.52.3 and more Source cves: CVE-2026-85008 Source advisory: OSV:GHSA-8436-99HF-9MMV...
@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +30 more potentially affected by CVE-2026-102676 via electron (>=43.0.0, <=43.4.0)
electron NPM version =43.0.0, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.208, =1.3.9 and more Source cves: CVE-2026-102676 Source advisory: SNYK:JS-ELECTRON-20335447...
@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +35 more potentially affected by CVE-2026-102677 via electron (>=43.0.0, <=43.4.1)
electron NPM version =43.0.0, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 - @sharpcaterpillar/pi-web 0.8.11 and more Source cves: CVE-2026-102677 Source advisory: SNYK:JS-ELECTRON-20335433...
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
Summary The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured...
GHSA-P9F8-WVJ8-2FG8 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
Summary The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured...
Malicious Package
Overview express-javascript is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview items-validator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview rai6jaisahthaghee5ou-loader-package is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...
ROOT-APP-GOBINARY-CVE-2025-58181 CVE-2025-58181 in golang.org/x/crypto - Patched by Root
Root has patched CVE-2025-58181 in the golang.org/x/crypto package for Root:Go. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-59877 CVE-2026-59877 in protobufjs - Patched by Root
Root has patched CVE-2026-59877 in the protobufjs package for Root:npm. Multiple fixed versions available...