803 matches found
PYSEC-2026-1240 changedetection.io Path Traversal
Summary When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked Details The root cause is the payload source:file:///etc/passwdpasses the regex here and also passes the check here wher...
changedetection.io Path Traversal
SummaryWhen a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked DetailsThe root cause is the payload source:file:///etc/passwdpasses the regex here and also passes the check here where ...
@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +8 more potentially affected by CVE-2026-13149 via brace-expansion (>=2.0.0, <=2.0.2)
brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-13149 Source advisory: MEND:CVE-2026-13149...
gabposter (>=1.2.5, <=1.2.8), open-webdriver (>=1.3.5, <=1.6.9) +4 more potentially affected by CVE-2026-55195 via py7zr (0.20.2)
py7zr PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - gabposter =1.2.5, =1.3.5, =1.0.4, =1.0.0, =1.0.10, =1.0.0, =1.2.86 Source cves: CVE-2026-55195 Source advisory: OSV:GHSA-GJRG-MPP7-G774...
gabposter (>=1.2.5, <=1.2.8), open-webdriver (>=1.3.5, <=1.6.9) +4 more potentially affected by CVE-2026-23879 via py7zr (0.20.2)
py7zr PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on py7zr and may be impacted: - gabposter =1.2.5, =1.3.5, =1.0.4, =1.0.0, =1.0.10, =1.0.0, =1.2.86 Source cves: CVE-2026-23879 Source advisory: OSV:GHSA-Q6RC-2CGV-63H7...
@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +8 more potentially affected by CVE-2026-33750 via brace-expansion (>=2.0.0, <=2.0.2)
brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-33750 Source advisory: SNYK:JS-BRACEEXPANSION-15789759...
Astra Linux – Vulnerability in Zabbix
The WebDriver for the Browser object expects an error object to be initialized when the webdriversessionquery function fails. However, this function can fail for various reasons without an error description. As a result, wd-error will be NULL, and attempting to access it will cause a crash...
EUVD-2025-178562
Malicious code in helios-webdriver-mocha-superposition-phylogenetics npm...
EUVD-2025-177025
Malicious code in procyon-spectron-webdriver-nestjs-gridsome npm...
EUVD-2025-175607
Malicious code in webdriver-mocha-browserify-polaris-cache npm...
EUVD-2025-175624
Malicious code in wavefunction-prompts-webdriver-mocha-vuetify npm...
EUVD-2025-179439
Malicious code in cygnus-umbra-webdriver-mocha-docusaurus npm...
EUVD-2025-176105
Malicious code in supernova-webdriver-mocha-centauri-vega npm...
EUVD-2025-180378
Malicious code in apollo-webdriver-manager-jasmine-wasat npm...
Malicious code in webdriver-manager-stratosphere-stratigraphy-stop (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0934643185b5cbcc16307cc870692bbaf0a0c6ef0085d73916acdc478aa082fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176257
Malicious code in spectroscopy-webdriver-manager-await-bootstrap npm...
EUVD-2025-176122
Malicious code in supercluster-webdriver-manager-pipe-alphard npm...
EUVD-2025-175600
Malicious code in webdriver-mocha-tectonic-leda-antimatter npm...