354447 matches found
NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop DoS vulnerability discovered by ? in WordPress Npm axios versions = 1.16.1, 1.20.0...
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engi...
SUSE CVE-2026-98137
In the Linux kernel, the following vulnerability has been resolved: ntfs: treat any nonzero dio zero-range return as an error ntfsdiozerorange returns either 0 or a negative errno from blkdevissuezeroout; it never returns a positive value. The zeroing failure check in ntfsattrfallocate therefore...
SUSE CVE-2026-102300
Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-102303
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-102325
Uninitialized resource in Skia in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...
Improper Certificate Validation
Snowflake drivers are vulnerable to Improper Certificate Validation. The vulnerability is due to improper validation of OCSP responses and treating definitive verification failures as transient, which allows a man-in-the-middle attacker with a revoked certificate and its private key to establish ...
rubygem-mongo: MongoDB Ruby Driver: Data disclosure and denial of service via query-operator injection
A flaw was found in the GridFS component of the MongoDB Ruby Driver. Improper neutralization of special elements in data query logic can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a literal identifier. An authenticated user who can...
Important: Red Hat Security Advisory: ruby:2.5 security update
An update for the ruby:2.5 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...
CVE-2025-39247
CVE-2025-39247 Objetivo: HikCentral Professional HCMP, servidor central VMS CVE: CVE-2025-39247 — Vulnerabilidad de Control de Acceso CVSS 3.1: 8.6 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Afectado: V2.3.1 – V2.6.2 y V3.0.0 Corregido: V2.6.3 / V3.0.1 / Fix-Pack CVE-2025-39247 Divulgado: 2025-08-28 Fec...
Malicious code in friendly-greeting-tools (PyPI)
Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...
MAL-2026-17416 Malicious code in friendly-greeting-tools (PyPI)
Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...
CVE-2024-10220-demo
This repository does not have a README...
CVE-2026-103388 MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTERVALIDATEURL validation. Because FILTERVALIDATEURL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could...
Cross-site Scripting (XSS)
Apache Wicket is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of attacker-influenced model data rendered inside elements, which allows an attacker to inject and execute malicious HTML or script content in a victim's browser...
CVE-2026-103044
A flaw was found in the MediaWiki EasyTimeline extension. An Extensible Markup Language XML injection vulnerability exists due to improperly serving image map files as XML data. A remote attacker could exploit this flaw by convincing a user to interact with specially crafted content, potentially...
netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...
Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.16 security update
A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
