125419 matches found
CVE-2026-49253 electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile joins the filename to the...
CVE-2026-49255 electerm: Command Injection in File System Operations (rmrf, mv, cp)
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf, mv, and cp functions. A malicious SSH or SFTP server can provide a...
CVE-2026-75917
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...
CVE-2026-75916
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...
CVE-2026-75917 SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...
CVE-2026-75916 SiYuan XSS-to-RCE via unescaped block metadata in hint popup
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...
Scammers are using fake crypto AML checkers to drain your wallet
Scammers are creating fake crypto wallet-checking sites that promise to tell you whether a wallet is linked to suspicious activity. Instead, they try to trick you into giving them access to your crypto. What real AML checking looks like AML stands for anti-money laundering. These are rules that...
Malicious code in evm-validation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...
MAL-2026-14301 Malicious code in evm-validation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...
Exploit for CVE-2026-47858
CVE-2026-47858 Replay Experiment Record Vulnerability: Sp...
ROOT-APP-NPM-CVE-2026-27904 CVE-2026-27904 in minimatch - Patched by Root
Root has patched CVE-2026-27904 in the minimatch package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-26996 CVE-2026-26996 in minimatch - Patched by Root
Root has patched CVE-2026-26996 in the minimatch package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-27903 CVE-2026-27903 in minimatch - Patched by Root
Root has patched CVE-2026-27903 in the minimatch package for Root:npm. Multiple fixed versions available...
Your polite reply to that text is worth $2 on the dark web
Most wrong-number texts are harmless. Some are the first step in a carefully planned scam. By replying, you may be confirming that your number is active and that you're willing to engage with strangers, making you a more valuable target for future fraud. Here's why a polite response can be worth...
ROOT-APP-GOBINARY-CVE-2026-39821 CVE-2026-39821 in golang.org/x/net - Patched by Root
Root has patched CVE-2026-39821 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-25680 CVE-2026-25680 in golang.org/x/net - Patched by Root
Root has patched CVE-2026-25680 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-25681 CVE-2026-25681 in golang.org/x/net - Patched by Root
Root has patched CVE-2026-25681 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2025-22872 CVE-2025-22872 in golang.org/x/net - Patched by Root
Root has patched CVE-2025-22872 in the golang.org/x/net package for Root:Go. Multiple fixed versions available...