30626 matches found
Malicious code in demo-awesome-date-parser-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5cccf4c1379e6c3f9af7dde45277b1c4db552a0ad878bc08378ad6e8879b497 The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoParseDate function invokes...
MAL-2026-11099 Malicious code in demo-awesome-date-parser-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5cccf4c1379e6c3f9af7dde45277b1c4db552a0ad878bc08378ad6e8879b497 The package advertises itself as a date parser but ships a heavily obfuscated payload in src/index.js. The exported demoParseDate function invokes...
CVE-2026-66394
Affected software: SiYuan prior to v3.7.3. Vulnerability: stored and reflected XSS via SVG sanitization bypassing the HTML parser-based cleaner, allowing authenticated attackers to run scripts. Trigger/context: scripts can be executed in the application origin when served as image/svg+xml by hidi...
GO-2026-5960 Excelize: Unbounded Row Index Allocation in Worksheet Parser (checkSheet OOM/Panic DoS) in github.com/xuri/excelize
Excelize: Unbounded Row Index Allocation in Worksheet Parser checkSheet OOM/Panic DoS in github.com/xuri/excelize...
GO-2026-5983 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy...
SUSE-SU-2026:3283-1 Security update for perl-DBI
This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. - CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a proce...
Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images
Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2025-13151 DESCRIPTION: Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1expendoctetstring...
Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues
Summary Multiple vulnerabilities affect IBM Sterling External Authentication Server and are addressed in the latest release and ifix Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not...
freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser
A flaw was found in FreeRDP. A malicious server can exploit a heap use-after-free or double-free vulnerability in the FreeRDP client's RDPEAR authentication-redirection path. This occurs because the RDPEAR NDR parser incorrectly handles pointer reference IDs, leading to the same heap object being...
PT-2026-65353
Excelize: Unbounded Row Index Allocation in Worksheet Parser checkSheet OOM/Panic DoS in github.com/xuri/excelize...
PT-2026-65354
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser in github.com/aquasecurity/trivy...
PT-2026-65067
Name of the Vulnerable Software and Affected Versions facil.io versions 0.7.5 through 0.7.6 Description A denial-of-service issue exists in the HTTP/1.1 chunked transfer encoding parser. An unauthenticated remote attacker can crash the server by sending a single POST request with a...
PT-2026-64995
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description Stored and reflected cross-site scripting issues exist in SVG sanitization. Authenticated attackers can bypass the HTML parser-based cleaner by hiding script tags within desc, style, or noscript...
PT-2026-65065
Name of the Vulnerable Software and Affected Versions facil.io versions 0.6.0 through 0.7.6 Description An integer underflow exists in the multipart MIME body parser. Unauthenticated remote attackers can crash the server process by sending a crafted Content-Disposition header with an empty field...
CVE-2026-59728: XML Injection (aka Blind XPath Injection)
Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Bot...
CVE-2026-66730: Loop with Unreachable Exit Condition
facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...
CVE-2026-66729: Out-of-bounds Read
facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32t wraparound ...
CVE-2026-66731: Out-of-bounds Read
facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding:...
PT-2026-65066
Name of the Vulnerable Software and Affected Versions facil.io versions 0.6.0 through 0.7.6 Description A denial-of-service issue exists in the multipart body parser. An unauthenticated remote attacker can freeze worker processes at 100% CPU by sending a multipart/form-data request containing a...
