NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference affecting VerifyVoteExtension and vote verification functions. An attacker can cause intermittent validator panics and disrupt consensus operations by submitting a VoteExtension message with the blockhash field...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference affecting VerifyVoteExtension and vote verification functions. An attacker can cause intermittent validator panics and disrupt consensus operations by submitting a VoteExtension message with the blockhash field...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference affecting VerifyVoteExtension and vote verification functions. An attacker can cause intermittent validator panics and disrupt consensus operations by submitting a VoteExtension message with the blockhash field...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference affecting VerifyVoteExtension and vote verification functions. An attacker can cause intermittent validator panics and disrupt consensus operations by submitting a VoteExtension message with the blockhash field...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference affecting VerifyVoteExtension and vote verification functions. An attacker can cause intermittent validator panics and disrupt consensus operations by submitting a VoteExtension message with the blockhash field...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference affecting VerifyVoteExtension and vote verification functions. An attacker can cause intermittent validator panics and disrupt consensus operations by submitting a VoteExtension message with the blockhash field...

cyclonedx-core-java: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

An XML External Entity XXE injection vulnerability was found in the CycloneDX Java core library’s XML validation step where the XML Validator was not configured securely. When a specially crafted CycloneDX BOM XML is validated, external XML entities can be processed XXE, allowing an attacker to...

ca.weblite:teavm-lambda-demo-auth (>=0.1.5, <=0.1.6), ca.weblite:teavm-lambda-demo-features (>=0.1.5, <=0.1.6) +244 more potentially affected by CVE-2025-66453 via org.mozilla:rhino (1.7.15)

org.mozilla:rhino MAVEN version 1.7.15 is affected by a known vulnerability. The following packages have a transitive dependency on org.mozilla:rhino and may be impacted: - ca.weblite:teavm-lambda-demo-auth =0.1.5, =0.1.5, =0.1.5, =0.1.5, =0.1.5, =0.1.5, =0.1.1, =0.1.1, =0.1.4, =1.9.0, =2.43.0,...

EUVD-2025-200244

Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions. The validator uses an insecure checksum algorithm; knowing this algorithm and the format of the license lines, an attacker can recalculat...

net.codinux.invoicing:e-invoice (>=0.5.0, <=0.5.2), net.codinux.invoicing:e-invoice-jvm (>=0.6.0, <=0.7.3) potentially affected by CVE-2025-66372 via org.mustangproject:validator (>=2.14.2, <=2.15.1)

org.mustangproject:validator MAVEN version =2.14.2, =0.5.0, =0.6.0, =0.7.3 Source cves: CVE-2025-66372 Source advisory: GHSA-X832-FPVJ-R5PH...

CVE-2025-12758

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength function that does not take into account Unicode variation selectors \uFE0F, \uFE0E appearing in a sequence which lead to improper string length...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the XML parsing process. An attacker can access sensitive files by submitting specially crafted XML data containing external entities. Details XXE Injection is a type of attack against an applicatio...

7ghost (>=4.11.0, <=4.11.46), @100k/type-graphql-filter-mikroorm (>=0.0.1, <=0.3.5) +1608 more potentially affected by CVE-2025-12758 via validator (>=13.0.0, <=13.15.20)

validator NPM version =13.0.0, =4.11.0, =0.0.1, =1.0.0, =0.0.0-dev-20240828032938, =0.1.1, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938,...

7ghost (>=4.11.0, <=4.11.46), @100k/type-graphql-filter-mikroorm (>=0.0.1, <=0.3.5) +1608 more potentially affected by CVE-2025-12758 via validator (>=13.0.0, <=13.15.20)

validator NPM version =13.0.0, =4.11.0, =0.0.1, =1.0.0, =0.0.0-dev-20240828032938, =0.1.1, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938, =0.0.0-dev-20240828032938,...

EUVD-2025-199795

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength function that does not take into account Unicode variation selectors \uFE0F, \uFE0E appearing in a sequence which lead to improper string length...

CVE-2025-12758

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength function that does not take into account Unicode variation selectors \uFE0F, \uFE0E appearing in a sequence which lead to improper string length...

CVE-2025-12758

CVE-2025-12758—Validator.js isLength() Unicode variation selector bypass . Multiple IBM advisories reference affected product lines (e.g., IBM App Connect Enterprise, QRadar) where validator versions earlier than 13.15.22 are vulnerable due to incomplete filtering of Unicode variation selectors i...

CVE-2025-12758

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength function that does not take into account Unicode variation selectors \uFE0F, \uFE0E appearing in a sequence which lead to improper string length...

01homework (>=1.0.0, <=1.0.1), 0xauth (>=0.0.2, <=0.0.6) +13213 more potentially affected by CVE-2025-12758 via validator (>=0.1.8, <=13.15.20)

validator NPM version =0.1.8, =1.0.0, =0.0.2, =0.0.6, =0.0.1, =0.0.2, =1.0.0, =0.0.1, =4.11.0, =1.17.6-next.0, =0.0.0-canary.0, =0.0.0-canary.6 and more Source cves: CVE-2025-12758 Source advisory: MEND:CVE-2025-12758...

CVE-2025-12758: Incomplete Filtering of One or More Instances of Special Elements

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength function that does not take into account Unicode variation selectors \uFE0F, \uFE0E appearing in a sequence which lead to improper string length...