6173 matches found
@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +211 more potentially affected by CVE-2026-23527 via h3 (>=1.0.1, <=1.15.4)
h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: CVE-2026-23527 Source advisory: OSV:GHSA-MP2G-9VG9-F4CG...
GHSA-MP2G-9VG9-F4CG h3 v1 has Request Smuggling (TE.TE) issue
I was digging into h3 v1 specifically v1.15.4 and found a critical HTTP Request Smuggling vulnerability. Basically, readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. The...
@0xgg/echomd (>=1.0.0, <=1.0.4), @7365admin1/layer-common (>=1.10.7, <=3.2.6) +264 more potentially affected by CVE-2026-22787 via html2pdf.js (>=0.9.3, <=0.13.0)
html2pdf.js NPM version =0.9.3, =1.0.0, =1.10.7, =1.0.12-beta.20, =1.0.1, =1.0.12-beta.1, =0.1.11, =1.0.7, =1.4.4, =1.13.2-dev.0, =1.29.0-rc.0, =1.3.1, =0.4.80, =0.3.9, =0.7.13 and more Source cves: CVE-2026-22787 Source advisory: SNYK:JS-HTML2PDFJS-14943969...
CVE-2025-9427
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Lemonsoft WordPress add on allows Cross-Site Scripting XSS.This issue affects WordPress add on: 2025.7.1...
Mozilla Firefox ESR Security Update (mfsa_2026-03) - Mac OS X
Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...
Fedora: Security Advisory (FEDORA-2026-13b4dbe546)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Google Chrome Security Update (stable-channel-update-for-desktop_13-2026-01) - Mac OS X
Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...
CVE-2023-54335
CVE-2023-54335 affects eXtplorer version 2.1.14. The vulnerability is an authentication bypass that allows login without a password by manipulating the login request, enabling attackers to upload malicious PHP files and execute remote commands on the vulnerable file management system. Severity is...
@a0dotrun/expose (>=0.0.2, <=0.0.4), @agentforce/adk (>=0.9.0, <=0.12.1) +297 more potentially affected by CVE-2026-22817 via hono (>=4.0.0, <=4.11.3)
hono NPM version =4.0.0, =0.0.2, =0.9.0, =0.1.9, =0.0.1, =0.0.1, =0.0.1, =0.0.1-experimental.1, =1.7.2, =1.7.1, =0.2.1, =0.6.1, =0.5.2, =0.0.3, =1.3.2, =1.3.17 and more Source cves: CVE-2026-22817 Source advisory: OSV:GHSA-F67F-6CW9-8MQ4...
PT-2026-2487
Name of the Vulnerable Software and Affected Versions Semantic machines version 5.4.8 Description An issue allows attackers to bypass authentication by sending a crafted HTTP request to various API endpoints. The attack targets authentication mechanisms within the software. The affected API...
3m (>=0.1.0, <=0.1.3), aap-llamaindex (>=0.1.1.dev1, <=0.2.0) +354 more potentially affected by CVE-2024-58339 via llama-index (>=0.4.17, <=0.14.23)
llama-index PYPI version =0.4.17, =0.1.0, =0.1.1.dev1, =0.1.8, =0.0.2, =1.1.0a20250502, =0.10.0, =1.4.3, =0.1.0a0.dev0, =0.2.0a0, =0.1.0, =0.1.0a1, =1.0.1 and more Source cves: CVE-2024-58339 Source advisory: SNYK:PYTHON-LLAMAINDEX-14917160...
EUVD-2026-1917
A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. The vulnerability is caused by flawed logic in the isdangerouspath validation function that uses exact string matching against a blacklist of system...
PT-2026-2134
Name of the Vulnerable Software and Affected Versions CryptoLib versions prior to 1.4.3 Description CryptoLib is a software solution utilizing the CCSDS Space Data Link Security Protocol - Extended Procedures SDLS-EP for secure communication between a spacecraft and a ground station. The write...
WordPress Woodpecker for WordPress plugin <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'formname' Shortcode Attribute vulnerability discovered by Gilang - DJ in WordPress Plugin Woodpecker for WordPress versions = 3.0.4...
4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +40 more potentially affected by CVE-2026-22610 via @angular/compiler (>=19.0.0, <=19.2.17)
@angular/compiler NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.346.0, =0.0.1-canary.0.0, =1.0.0-canary.1 - @ismailadekambi/shared 1.0.0 and more Source cves: CVE-2026-22610 Source advisory:...
@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.160) +26 more potentially affected by CVE-2026-22610 via @angular/compiler (>=20.0.0, <=20.3.15)
@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.8.0, =12.0.0-14, =13.0.0-1 and more Source cves: CVE-2026-22610 Source advisory: OSV:GHSA-JRMJ-C5CX-3CW6...
CVE-2021-22658
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'...
CVE-2022-26268
Xiaohuanxiong v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /app/controller/Books.php...
CVE-2020-24639
There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system...