191 matches found
CVE-2026-27606
A flaw was found in Rollup, a JavaScript module bundler. Insecure file name sanitization in the core engine allows an attacker to control output filenames, potentially through command-line interface CLI inputs, manual chunk aliases, or malicious plugins. By using directory traversal sequences ../...
Webpack 代码问题漏洞
Webpack is a module bundler developed by Webpack contributors. Its primary purpose is to bundle JavaScript files for use in browsers. However, it can also convert, bundle, or package almost any resource or asset. Versions of Webpack from 5.49.0 to 5.104.1 contained code vulnerabilities. These...
CVE-2026-25143 melange affected by potential host command execution via license-check YAML mode patch pipeline
melange allows users to build apk packages using declarative pipelines. From version 0.10.0 to before 0.40.3, an attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds...
📄 MiniCMS 1.11 Exploitation Toolkit
This toolkit focuses on validating and demonstrating the impact of a known and documented design flaw in MiniCMS 1.11 related to its build process CVE-2018-1000638. MiniCMS relies on an insecure build.php script that blindly packages filesystem contents into install.php without enforcing integrit...
MiracleLinux 3 : util-linux-2.13-0.59.0.1.AXS3 (AXSA:2012-269:01)
The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2012-269:01 advisory. The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. Among others,...
Characterizing Build Compromises through Vulnerability Disclosure Analysis
The software build process transforms source code into deployable artifacts, representing a critical yet vulnerable stage in software development. Build infrastructure security poses unique challenges: the complexity of multi-component systems source code, dependencies, build tools, the difficult...
SUSE-SU-2025:03523-1 Security update for openssl-1_1-livepatches
This update for openssl-11-livepatches fixes the following issues: - Add livepatch for CVE-2025-9230 bsc1250410. - Use strong externalization for ssl3setupreadbuffer and ssl3releasereadbuffer - Use strong externalization for osslstatemfatal. - Add livepatch for CVE-2024-4741 bsc1225552. - Drop...
EUVD-2021-14589
Malware in sbrugna...
EUVD-2018-4517
Malware in sbrugna...
EUVD-2024-3552
Malicious code in bioql PyPI...
EUVD-2022-5740
Malicious code in bioql PyPI...
EUVD-2025-12810
Malicious code in bioql PyPI...
EUVD-2024-31871
Malicious code in bioql PyPI...
EUVD-2024-2818
Malicious code in bioql PyPI...
EUVD-2024-45943
Malicious code in bioql PyPI...
EUVD-2024-2994
Malicious code in bioql PyPI...
EUVD-2024-3384
Malicious code in bioql PyPI...
CLSA-2025-1759497739 perl-HTTP-Tiny: Fix of CVE-2023-31486
CVE-2023-31486: fix insecure default TLS configuration - Enable automated tests during build...
DependencyCheck
This is an open-source project for a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies. The project is called OWASP dependency-check. The project is written in Java and is designed to be used in a variety of environments, including...
Linux Distros Unpatched Vulnerability : CVE-2018-6574
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow go get remote command execution during source code build, by leveraging...