42392 matches found
CVE-2026-24131 pnpm has Path Traversal via arbitrary file permission modification
pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's directories.bin field, it uses path.join without validating the result stays within the package root. A malicious npm package can specify "directories": "bin": "../../../../tmp" to escape the package directory,...
Directory Traversal
Overview @pnpm/package-bins is a that returns bins of a package. Affected versions of this package are vulnerable to Directory Traversal via the getBinsFromPackageManifest function. An attacker can modify file permissions outside the intended directory by supplying a crafted value in the...
CVE-2025-9820
A flaw was found in the GnuTLS library, specifically in the gnutlspkcs11tokeninit function that handles PKCS11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the applicatio...
GHSA-WV3H-X6C4-R867 vulnerabilities
Vulnerabilities for packages: keycloak, keycloak-fips...
CVE-2026-23960 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, argo-workflows-fips, argo-workflows...
CVE-2024-3036
creationtimestamp| type| source ---|---|--- 2026-01-26 18:54:31+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/control-systems-abb-security-advisory-av26-055...
CVE-2025-69204 vulnerabilities
Vulnerabilities for packages: imagemagick...
USN-7976-1 node-form-data vulnerability
Ben Shonaldmann discovered that Form-data incorrectly generated boundary values for multipart form-encoded data, leading to predictable values. A remote attacker could possibly use this issue to make arbitrary requests to internal systems...
USN-7976-1: Form-Data vulnerability
Ben Shonaldmann discovered that Form-data incorrectly generated boundary values for multipart form-encoded data, leading to predictable values. A remote attacker could possibly use this issue to make arbitrary requests to internal systems...
PT-2026-4732
Name of the Vulnerable Software and Affected Versions WellChoose Single Sign-On Portal System affected versions not specified WellChoose Organization Portal System affected versions not specified Description An OS Command Injection issue exists in the WellChoose Portal Systems, potentially allowi...
pnpm security vulnerabilities
PNPM is a package manager developed by the open-source project Pnpm. Versions of Pnpm prior to 10.28.2 had security vulnerabilities. These vulnerabilities stemmed from the lack of path validation when processing the directories.bin field of packages. This allowed malicious npm packages to modify...
Pwn2Own: Researchers Earn $1 Million for 76 Zero-Days
Discover how TrendAI Zero Day Initiative ZDI identified critical vulnerabilities across connected vehicles, EV chargers, and automotive systems...
VulnCheck KEV: CVE-2022-40619
FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to unauthenticated arbitrary command injection through the funjsqaccesstoken parameter. This affects R6230 before...
Malicious code in overstock-login-layer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 359cd99825c90001defddafc25d74d784b4e71a75a8adf92e90f2371dbf8a124 The package overstock-login-layer was found to contain malicious code. Source: ghsa-malware...
Linux Distros Unpatched Vulnerability : CVE-2025-71163
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: idxd: fix device leaks on compat bind and unbind Make sure to drop the reference taken when looking up the idxd device as part of the compat bind and...
CVE-2026-24049 vulnerabilities
Vulnerabilities for packages: py3-virtualenv, kserve, pypy-3.10, dask-kubernetes, kubeflow-katib, airflow, open-webui, py3-setuptools, superset, pypy-3.11, emissary, mlflow, kubeflow-jupyter-web-app, pip-zipapp, aws-cli, py3-cassandra-medusa, semgrep, datadog-agent...
GHSA-8RRH-RW8J-W5FX vulnerabilities
Vulnerabilities for packages: aws-cli, py3-cassandra-medusa, tensorflow-gpu-jupyter, dbt-bigquery, awx, apache-beam-python-3.11-sdk, tritonserver-backend-vllm-cuda-12.9, pypy-3.11, wazuh-manager-fips, superset, duplicity, text-generation-inference, ghidra, dask-kubernetes, airflow,...
CVE-2025-67221 vulnerabilities
Vulnerabilities for packages: emissary, authentik-fips, kserve, datadog-agent-fips, litellm, authentik, datadog-agent...