12841 matches found
CVE-2026-21715
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under --permission with restricted --allow-fs-read can still use...
EUVD-2026-16734
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance...
CVE-2025-66215 OpenSC: Stack-buffer-overflow WRITE in card-oberthur
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow WRITE in card-oberthur. The attack requires crafted USB device or smart card that...
CVE-2025-49010
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, an attacker with physical access to the computer at the time user or administrator uses a token can cause a stack-buffer-overflow write in GET RESPONSE. The attack requires crafted USB device or smart card that wou...
CVE-2026-28526
creationtimestamp| type| source ---|---|--- 2026-03-30 16:58:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mic52zm2uf25...
Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2026-1484)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1484 advisory. A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js...
Node.js 安全漏洞
Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. Security vulnerabilities exist in Node.js versions 20.x, 22.x, 24.x, and 25.x. These vulnerabilities stem from improper handling of HTTP requests. When the request header contains the name...
ROOT-OS-ALPINE-320-CVE-2023-46045 CVE-2023-46045 in rootio-graphviz - Patched by Root
Root has patched CVE-2023-46045 in the rootio-graphviz package for Root:Alpine:3.20. Multiple fixed versions available...
ROOT-OS-ALPINE-320-CVE-2024-10525 CVE-2024-10525 in rootio-mosquitto - Patched by Root
Root has patched CVE-2024-10525 in the rootio-mosquitto package for Root:Alpine:3.20. Multiple fixed versions available...
ROOT-OS-ALPINE-320-CVE-2024-3935 CVE-2024-3935 in rootio-mosquitto - Patched by Root
Root has patched CVE-2024-3935 in the rootio-mosquitto package for Root:Alpine:3.20. Multiple fixed versions available...
ROOT-OS-ALPINE-320-CVE-2024-8376 CVE-2024-8376 in rootio-mosquitto - Patched by Root
Root has patched CVE-2024-8376 in the rootio-mosquitto package for Root:Alpine:3.20. Multiple fixed versions available...
CVE-2026-33767
WWBN AVideo is an open source video platform. In versions up to and including 26.0, in objects/like.php, the getLike method constructs a SQL query using a prepared statement placeholder ? for usersid but directly concatenates $this-videosid into the query string without parameterization. An...
CVE-2026-3457
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Thales Sentinel LDK Runtime on Windows allows Stored XSS.This issue affects Sentinel LDK Runtime: before 10.22...
[SECURITY] Fedora 42 Update: htslib-1.23.1-1.fc42
HTSlib is an implementation of a unified C library for accessing common file formats, such as SAM, CRAM and VCF, used for high-throughput sequencing data, and is the core library used by samtools and bcftools...
SUSE CVE-2026-33496
ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The oauth2introspection authenticator cache does not distingui...
CVE-2026-33495
ORY Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Ory Oathkeeper is often deployed behind other components like CDNs, WAFs, or reverse proxies. Depending on the setup, another component might forward the...
CVE-2026-34375
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the $REQUEST'plugin' parameter into a JavaScript block without any encoding or sanitization. The plugin parameter is not included in any of the...
Insufficient Session Expiration
Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the password reset process. An attacker can gain unauthorized access to a user's account by reusing a previously obtained password reset token within its validity period, even after the user has change...
GHSA-3458-R943-HMX4 Fleet: Password reset tokens remain valid after password change for 24 hours
Summary A vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain valid after a user changes their password. As a result, a stale password reset token could be reused to reset the account password even after a defensive password change...