CVE-2026-13323

Vulnerability CVE-2026-13323 affects Open VSX Registry before 1.0.2. The /vscode/unpkg/ endpoint serves user-supplied HTML without CSP or Content-Disposition headers, enabling a publisher to upload a crafted VSIX and lure authenticated users to visit the URL. This inline rendering in the open-vsx...

CVE-2026-13323

In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a publisher account, upload a VSIX...

Creation of Temporary File in Directory with Insecure Permissions

Overview @mariozechner/pi-coding-agent is a Coding agent CLI with read, bash, edit, write tools and session management Affected versions of this package are vulnerable to Creation of Temporary File in Directory with Insecure Permissions in the process handling temporary extension package installs...

CVE-2021-47964 Schlix CMS 2.2.6-6 Remote Code Execution via core.blockmanager

Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and...

EUVD-2021-34817

Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and...

EUVD-2025-38183

Malicious code in revenuecat-mcp-extension npm...

Malicious code in http-message-signatures-extension (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-38651 Malicious code in vscode-extend (npm)

The package vscode-extend was found to contain malicious code...

Malicious code in dt-adoptionoverview-extension (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @aznb/extension-gather (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13a2e820f4b76b96754e20b5f4690c511ba979707ff6d1f9dc14a6cbf1e658e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Directory traversal

Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive...

AIX 520010 : U815011

The remote host is missing AIX PTF U815011 which is related to the security of the package X11.samples.ext You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...