10709 matches found
CVE-2026-58315
creationtimestamp| type| source ---|---|--- 2026-07-07 05:45:04+00:00| seen| https://jvn.jp/en/jp/JVN87285119 2026-07-07 08:19:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq267jrzbg26...
MINI-25PR-CVW3-X27P
Bulletin has no description...
MINI-WPHR-V4H5-96HR
Bulletin has no description...
MINI-VGPG-HQ2Q-CVMJ
Bulletin has no description...
CGA-5V5F-JMP6-VFXM
Bulletin has no description...
python3.14-pip security update
25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion + remove unused metadata file 25.2-4 - Security fix for CVE-2026-8643: path traversal in wheel entry points...
Craft CMS: Stored XSS via Structure entry title in table view
Stored XSS via Structure entry title in table view Summary An Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the...
Cross-site Scripting (XSS)
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the ElementTableSorter.js process when a user with sufficient permissions drags an entry under a maliciously crafted entry in table view. An attacker can execute...
EUVD-2026-41153
Craft CMS: Stored XSS via Structure entry title in table view...
GHSA-XRQC-P465-2XVG Craft CMS: Stored XSS via Structure entry title in table view
Stored XSS via Structure entry title in table view Summary An Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with saveEntries for the same Structure section, drags another entry under the poisoned entry in table view, the...
Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
Summary POST /api/v2/files converts zip uploads to tar in memory via CreateTarFromZip, which enforced a per-entry size limit but no aggregate limit on total decompressed output, writing to an unbounded in-memory buffer. Note: Exploitation requires authenticated file-upload access and the impact i...
Malicious code in linter-entry (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dd46817b425ee73f1443401b7abcea1d2073f392c91f1af29974ac07a4fe20e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview linter-entry is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-6847 Malicious code in linter-entry (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dd46817b425ee73f1443401b7abcea1d2073f392c91f1af29974ac07a4fe20e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in es-lint-entry (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7abab05be195342f311825ea394c11273032428d1bd122dd4fe31f8a5b8da554 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6835 Malicious code in es-lint-entry (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7abab05be195342f311825ea394c11273032428d1bd122dd4fe31f8a5b8da554 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-54893
creationtimestamp| type| source ---|---|--- 2026-07-06 16:40:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyjqv6pcp2z...
CVE-2026-59194
pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This vulnerability is fixed in 10.34.4 and 11.7.0...