19405 matches found
GHSA-HC8W-H2MF-HP59
creationtimestamp| type| source ---|---|--- 2026-04-23 21:25:36+00:00| published-proof-of-concept| Telegram/tS2ffuiIBjg-jG5ou8TlrNJjBU2OGhcKfhZwclhyaQjdHg...
Improper Neutralization
Overview Affected versions of this package are vulnerable to Improper Neutralization of inline in the BaseCookie.jsoutput function. An attacker can inject arbitrary script content by supplying specially crafted input containing HTML parser-sensitive sequences. Remediation A fix was pushed into th...
RUSTSEC-2026-0108 `sui-execution-cut` was removed from crates.io for malicious code
sui-execution-cut included a build script that attempted to exfiltrate data from the build machine. The malicious crate had 1 version published on 2026-04-20 and had no evidence of actual usage. This crate had no dependencies on crates.io...
Uncontrolled Recursion
Overview org.webjars.npm:xmldom is an A pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive processing of deeply nested XML documents by several DOM-related...
Out-of-bounds Read
Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the endpoint process. An attacker can access sensitive information and cause a denial of service by sending a maliciously crafted request. Remediation A fix was pushed into the master branch but not yet published...
GHSA-9C4Q-HQ6P-C237
creationtimestamp| type| source ---|---|--- 2026-04-22 03:15:49+00:00| published-proof-of-concept| Telegram/NIz4Hq2d69t6fRYm4ZcrXWZIskbJKFNbLYHbUSSyCcR9Mzg...
GHSA-GPH2-J4C9-VHHR
creationtimestamp| type| source ---|---|--- 2026-04-21 23:30:36+00:00| published-proof-of-concept| Telegram/ITN0hTjNGfPMK-REHkV5qJBsGo4t4-tf1bJT5aod5DHh0UQ...
GHSA-6RC6-P838-686F
creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:33+00:00| published-proof-of-concept| Telegram/PLPaRbcJDaPiLP6CzuoYppan71AlFD-MBdwXLbLZgMJCSE...
CVE-2026-40903
creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:33+00:00| published-proof-of-concept| Telegram/PLPaRbcJDaPiLP6CzuoYppan71AlFD-MBdwXLbLZgMJCSE...
GHSA-HPXJ-9FGP-FHHF
creationtimestamp| type| source ---|---|--- 2026-04-21 21:27:33+00:00| published-proof-of-concept| Telegram/PLPaRbcJDaPiLP6CzuoYppan71AlFD-MBdwXLbLZgMJCSE...
CVE-2026-40614
creationtimestamp| type| source ---|---|--- 2026-04-21 21:26:08+00:00| published-proof-of-concept| Telegram/Sh-VDLwDsigv2TtmIHQb5bM9xL-0-hntwqefkM3TigDwq8o...
Cleartext Transmission of Sensitive Information
Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the Kerberos credentialing. An attacker can intercept sensitive information by capturing unencrypted credentials during transmission. Remediation A fix was pushed into the master branch...
Use of a Broken or Risky Cryptographic Algorithm
Overview Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm in the cryptographic algorithm implementation. An attacker can compromise the confidentiality of sensitive information by exploiting weak or insufficient cryptographic algorithms...
GHSA-5JW5-Q9J7-4RXC
creationtimestamp| type| source ---|---|--- 2026-04-21 17:18:19+00:00| published-proof-of-concept| Telegram/Dp3cHxEcbabtcr78eMwYzIZdIkaK3NXYlVFRQJBCFObozHI...
GHSA-8RH7-6779-CJQQ
creationtimestamp| type| source ---|---|--- 2026-04-21 01:18:26+00:00| published-proof-of-concept| Telegram/Ww620GgPpyXrrMPbpNwPksYQUctI-RNYBJrVLxtJIutZ-I...
GHSA-69RW-45WJ-G4V6
creationtimestamp| type| source ---|---|--- 2026-04-20 23:18:29+00:00| published-proof-of-concept| Telegram/9Djse05P71eOqOBKGWSEvRis3v2yPmwIHyqqWc98-IGQuI...
GHSA-HV3X-4W38-R92M
creationtimestamp| type| source ---|---|--- 2026-04-20 23:18:29+00:00| published-proof-of-concept| Telegram/9Djse05P71eOqOBKGWSEvRis3v2yPmwIHyqqWc98-IGQuI...
Command Injection
Overview flowsint is an Add your description here Affected versions of this package are vulnerable to Command Injection via the orgtoasn transform process. An attacker can execute arbitrary operating system commands as root on the host machine by supplying shell metacharacters and escaping the...
Arbitrary File Upload
Overview Affected versions of this package are vulnerable to Arbitrary File Upload due to concatenating tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. An attacker can cause unintended files to be installed by supplying a specially crafted archi...