112719 matches found
CVE-2026-49459
A flaw was found in DOMPurify, a library designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. A remote attacker could exploit a vulnerability in the DOMPurify.sanitize function when used with the INPLACE: true option. This flaw allows an attacker to bypass the...
Malicious code in eslintcmd (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf4500fbbfc85f42275772210ace6efb69c5f90d9d0a5edd7c0c75fa271f0c3 The package's postinstall script scripts/install-check.cjs fetches a JSON config from https://slimopump.vercel.app/config/clob-math.json, downloads...
MAL-2026-10670 Malicious code in eslintcmd (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf4500fbbfc85f42275772210ace6efb69c5f90d9d0a5edd7c0c75fa271f0c3 The package's postinstall script scripts/install-check.cjs fetches a JSON config from https://slimopump.vercel.app/config/clob-math.json, downloads...
MAL-2026-10634 Malicious code in estore-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...
Malicious code in ai-pro-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...
Malicious code in @leviosa86com/leviosa86-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...
MAL-2026-10625 Malicious code in @leviosa86com/leviosa86-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd,...
ROS-20260715-73-0024
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to the use of memory after deallocation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-61859: Improper Link Resolution Before File Access
ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy...
CVE-2026-38753
A use-after-free in the awksub function editors/awk.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
CVE-2026-26719
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...
CVE-2026-38752
A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
Microsoft SharePoint SPFieldMultiLineText Cross-Site Scripting Vulnerability
This vulnerability allows remote attackers to execute web requests with a target user's privileges on affected installations of Microsoft SharePoint. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific fl...
CVE-2026-38753
A use-after-free in the awksub function editors/awk.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
CVE-2026-26718
A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application, affecting versions prior to 3.4.0 (specifically noted in version 3.0.0). The flaw stems from an endpoint that lacks proper CSRF token validation and utilizes a permissive request mapping that accepts ar...
CVE-2026-38752
A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
CVE-2026-38753
A use-after-free in the awksub function editors/awk.c of Busybox v1.38.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
CVE-2026-38752: Uncontrolled Recursion
A stack overflow in the evaluate function editors/awk.c of BusyBox commit 371fe9 allows attackers to cause a Denial of Service DoS via supplying a crafted AWK script...
PT-2026-60142
PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run skill script that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended...
PT-2026-60150
Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 ImageMagick versions 6.9.13-x prior to 6.9.13-51 Description A policy bypass exists in the -script operation due to missing security policy checks. This flaw allows the reading of files from paths that ar...