CVE-2025-56648

npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them...

CVE-2025-56648

npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them...

CVE-2025-56648

CVE-2025-56648 affects npm parcel 2.0.0-alpha and earlier, with an Origin Validation Error. The vulnerability allows a malicious site to send XMLHTTPRequests to the development server and read the response, potentially stealing source code when developers visit the site. The CVSSv3.1 base score i...

CVE-2025-56648

npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them...

PT-2025-38252

Name of the Vulnerable Software and Affected Versions parcel versions 2.0.0-alpha and earlier Description A security issue exists in Parcel that allows malicious websites to send XMLHTTPRequests to the application's development server and read the response, potentially leading to source code thef...

Linux Distros Unpatched Vulnerability : CVE-2015-3845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of...

Linux Distros Unpatched Vulnerability : CVE-2019-2118

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In various functions of Parcel.cpp, there are uninitialized or partially initialized stack variables. These could lead to local information disclosure with no...

Linux Distros Unpatched Vulnerability : CVE-2022-20474

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This could lead to local...

Google Android elevation of privilege vulnerability (CNVD-2025-23034)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability caused by an out-of-bounds write due to a heap-based buffer overflow in the appendFrom function in Parcel.cpp. An attacker can exploit the vulnerability to...

CVE-2025-32325

In appendFrom of Parcel.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48535

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. Us...

Malicious code in sirius-warp-quantum-parcel (npm)

The package sirius-warp-quantum-parcel was found to contain malicious code...

MAL-2025-43825 Malicious code in cladistics-decoherence-perseus-parcel (npm)

The package cladistics-decoherence-perseus-parcel was found to contain malicious code...

MAL-2025-45282 Malicious code in nebula-browserify-parcel-rocket (npm)

The package nebula-browserify-parcel-rocket was found to contain malicious code...

Malicious code in parcel-stop-paleontology-hydrogeology (npm)

The package parcel-stop-paleontology-hydrogeology was found to contain malicious code...

Malicious code in nebula-browserify-parcel-rocket (npm)

The package nebula-browserify-parcel-rocket was found to contain malicious code...

MAL-2025-46072 Malicious code in sirius-warp-quantum-parcel (npm)

The package sirius-warp-quantum-parcel was found to contain malicious code...

Malicious code in cladistics-decoherence-perseus-parcel (npm)

The package cladistics-decoherence-perseus-parcel was found to contain malicious code...

MAL-2025-45505 Malicious code in parcel-stop-paleontology-hydrogeology (npm)

The package parcel-stop-paleontology-hydrogeology was found to contain malicious code...

CVE-2025-48535

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. Us...