29 matches found
Linux Distros Unpatched Vulnerability : CVE-2025-25977
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement. CVE-2025-25977 Note that Nessus relies on...
org.webjars.npm:adal-node (0.1.28), org.webjars.npm:canvg (>=1.5.2, <=1.5.3) +15 more potentially affected by CVE-2026-41673 via org.webjars.npm:xmldom (>=0.1.31, <=0.6.0)
org.webjars.npm:xmldom MAVEN version =0.1.31, =1.5.2, =0.7.2, =0.14.0, =0.11.0, =7.14.0, =7.14.1 and more Source cves: CVE-2026-41673 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16134531...
org.webjars.npm:adal-node (0.1.28), org.webjars.npm:canvg (>=1.5.2, <=1.5.3) +15 more potentially affected by CVE-2026-41674 via org.webjars.npm:xmldom (>=0.1.31, <=0.6.0)
org.webjars.npm:xmldom MAVEN version =0.1.31, =1.5.2, =0.7.2, =0.14.0, =0.11.0, =7.14.0, =7.14.1 and more Source cves: CVE-2026-41674 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16134550...
org.webjars.npm:adal-node (0.1.28), org.webjars.npm:canvg (>=1.5.2, <=1.5.3) +15 more potentially affected by CVE-2026-34601 via org.webjars.npm:xmldom (>=0.1.31, <=0.6.0)
org.webjars.npm:xmldom MAVEN version =0.1.31, =1.5.2, =0.7.2, =0.14.0, =0.11.0, =7.14.0, =7.14.1 and more Source cves: CVE-2026-34601 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15869638...
EUVD-2025-6266
Malicious code in bioql PyPI...
canvg Prototype Pollution
The vulnerability of the StyleElement class in the SVG image processing library is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability could allow a malicious actor to execute a “prototype pollution” attack...
GHSA-V2MW-5MCH-W8C5 canvg Prototype Pollution vulnerability
An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement...
canvg Prototype Pollution vulnerability
An issue in canvg prior to v.4.0.3 and v3.0.11 can lead to prototype pollution via the Constructor of the class StyleElement...
@ts3d-hoops/web-viewer (>=2026.5.0, <=2026.6.0), @ts3d-hoops/web-viewer-components (>=2026.5.0, <=2026.6.0) +5 more potentially affected by CVE-2025-25977 via canvg (4.0.1)
canvg NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on canvg and may be impacted: - @ts3d-hoops/web-viewer =2026.5.0, =2026.5.0, =2026.5.0, =2026.5.0, =0.1.3, =1.22.9-beta.0, =1.0.9, =3.0.9 Source cves: CVE-2025-25977 Source advisory:...
@ts3d-hoops/web-viewer (>=2026.5.0, <=2026.6.0), @ts3d-hoops/web-viewer-components (>=2026.5.0, <=2026.6.0) +5 more potentially affected by CVE-2025-25977 via canvg (4.0.1)
canvg NPM version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on canvg and may be impacted: - @ts3d-hoops/web-viewer =2026.5.0, =2026.5.0, =2026.5.0, =2026.5.0, =0.1.3, =1.22.9-beta.0, =1.0.9, =3.0.9 Source cves: CVE-2025-25977 Source advisory:...
DEBIAN-CVE-2025-25977
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement...
CVE-2025-25977
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement...
UBUNTU-CVE-2025-25977
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement...
CVE-2025-25977
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement...
@0xgg/echomd (>=1.0.0, <=1.0.4), @amcharts/amcharts4 (>=4.0.0-beta.48, <=4.9.21) +302 more potentially affected by CVE-2025-25977 via canvg (>=0.0.5, <=3.0.10)
canvg NPM version =0.0.5, =1.0.0, =4.0.0-beta.48, =0.1.0, =1.13.6, =3.8.2, =0.2.2, =0.0.3, =1.0.0, =2.6.4, =0.0.21, =2.2.1, =1.5.3, =1.6.1 and more Source cves: CVE-2025-25977 Source advisory: MEND:CVE-2025-25977...
CVE-2025-25977: Improperly Controlled Modification of Object Prototype Attributes
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement...
CVE-2025-25977
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement...
CVE-2025-25977
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement...
CVE-2025-25977
An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the StyleElement class. This vulnerability is associated with CWE-1321 (Prototype Pollution). Currently, there is no vendor-supplied patch available for the impacted packages on Linux/Unix hosts.
