319344 matches found
CVE-2026-56096
The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values...
Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)
More info at https://contao.org/en/security-advisories/path-traversal-in-the-images-controller...
Malicious code in desmosmathwork (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eccdafeec1f447c84fcca9f7f17e41c8e940b8bd65c9caf72b1bddbb2befdea4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Duplicate Advisory: Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-47ch-6w46-6xm7. This link is maintained to preserve external references. Original Description Grav CMS before 2.0.16 contains a path traversal vulnerability in the mediadirectory Twig function that fails to...
CVE-2026-16286: Unrestricted Upload of File with Dangerous Type
Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee...
CVE-2026-21753: Use of Unmaintained Third Party Components
HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment...
PT-2026-81260
Name of the Vulnerable Software and Affected Versions HCL Hive affected versions not specified Description HCL Hive is affected by weak software supply chain governance. This issue could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the applicatio...
PT-2026-81316
Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management allows Upload a Web Shell to a Web Server. This issue affects Software Repository Management: before 2fb4acee...
CVE-2026-75370
An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service DoS via supplying a crafted CAN message...
Malicious code in unifi-credential-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c9d5fc3394d6f2565267e1b19573ca0c58dbbe9149f7204ea39ccae5c53645f package.json declares a preinstall hook that runs index.js on npm install. index.js collects hostname, username, working directory, internal IPv4...
Malicious code in mongosooe (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in lil-swisgom-hlepers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75aeaaa8ef6f56423bf517d9ff21cfed3a682701f306103f068b948e330f03db package.json declares a dependency lil-swisgom-hlepers-core whose version specifier is a direct tarball URL on a third-party host...
Malicious code in leaflet-opencage-geocoding (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @x-team/strapi (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @pimy-b2cweb/common (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @ice-trade-components/common (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @grab-food/order-sdk-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa9b56bb1d69dc16b6095faea196af99809ad805b400a3c6b5499f896c8d74c2 Package published under a scope impersonating the Grab food-ordering brand with no real functionality index.js exports an empty object. Its sole...
Malicious code in @bpa-internal/bpa-utils (npm)
--- -= Per source details. Do not edit below this line.=-...