1156612 matches found
GHSA-RQQ5-2GF9-4W4Q Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
Summary secureheaders builds the Content-Security-Policy value by stitching every configured directive together with ; separators. Three directive builders buildsandboxlistdirective, buildmediatypelistdirective, buildreporttodirective interpolate caller-supplied strings into that value without...
CVE-2026-49834 vulnerabilities
Vulnerabilities for packages: kyverno-fips, image-factory-fips, ratify, tflint, zarf-fips, tkn-fips, teleport-operator-fips, kyverno, crossplane, crossplane-fips, falcoctl, policy-controller, kyverno-notation-aws, trivy, zarf, tekton-chains, kubescape, tekton-chains-fips, kyverno-notation-aws-fip...
GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities
Vulnerabilities for packages: kyverno-fips, image-factory-fips, ratify, tflint, zarf-fips, tkn-fips, teleport-operator-fips, kyverno, crossplane, crossplane-fips, falcoctl, policy-controller, kyverno-notation-aws, trivy, zarf, tekton-chains, kubescape, tekton-chains-fips, kyverno-notation-aws-fip...
GHSA-9VCR-P3RJ-Q5Q6 vulnerabilities
Vulnerabilities for packages: aactl, kyverno-notation-aws, tekton-chains, trivy, policy-controller, kyverno, ratify, crossplane, gitsign, kubescape, tkn, trivy-operator, tflint, zarf, neuvector-sigstore-interface, falcoctl...
CVE-2026-49834 vulnerabilities
Vulnerabilities for packages: aactl, kyverno-notation-aws, tekton-chains, trivy, policy-controller, kyverno, ratify, crossplane, gitsign, kubescape, tkn, trivy-operator, tflint, zarf, neuvector-sigstore-interface, falcoctl...
GHSA-QV4M-M73M-8HJ7 NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)
Summary An authenticated user with the HR "Manage Employees" permission SAEMPLOYEE can upload a file with an arbitrary extension through the employee Documents tab. The handler writes the raw client-supplied filename — extension intact — into a web served directory with no extension, MIME, or...
NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)
Summary An authenticated user with the HR "Manage Employees" permission SAEMPLOYEE can upload a file with an arbitrary extension through the employee Documents tab. The handler writes the raw client-supplied filename — extension intact — into a web served directory with no extension, MIME, or...
GHSA-M8GF-V64P-GFMG BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The loaddata method strips only NUL bytes from a PDF-controlled CMap name, then...
BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py
Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The loaddata method strips only NUL bytes from a PDF-controlled CMap name, then...
MAL-2026-10165 Malicious code in @injectivelabs/sdk-ts (npm)
@injectivelabs/[email protected] published 2026-07-08 20:59 UTC contains a wallet-credential stealer disguised as "key derivation telemetry". A file packages/sdk-ts/src/utils/key-derivation-telemetry.ts plus a hook added to packages/sdk-ts/src/core/accounts/PrivateKey.ts capture wallet secrets durin...
Malicious code in @injectivelabs/sdk-ts (npm)
@injectivelabs/[email protected] published 2026-07-08 20:59 UTC contains a wallet-credential stealer disguised as "key derivation telemetry". A file packages/sdk-ts/src/utils/key-derivation-telemetry.ts plus a hook added to packages/sdk-ts/src/core/accounts/PrivateKey.ts capture wallet secrets durin...
CVE-2026-55638
9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/ to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/ to bypass the API-k...
CVE-2026-39903
Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An...
Malicious code in ap3-components-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d97e0570ae62fdcbbbd0f4cd4844cf39d0b77a0d4bb346dd6dcb748f0300c43 Package 'ap3-components-ui' at version 9.999.0 declares a preinstall hook "node index.js /dev/null 2&1" that shells out to collect installer-side...
MAL-2026-10150 Malicious code in ap3-components-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d97e0570ae62fdcbbbd0f4cd4844cf39d0b77a0d4bb346dd6dcb748f0300c43 Package 'ap3-components-ui' at version 9.999.0 declares a preinstall hook "node index.js /dev/null 2&1" that shells out to collect installer-side...
Malicious code in polygon-gama-apis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0e5efa9d57dae04a6082dfa776d2c2664f3ce5a838ed9cf56f40656937b7e92 polygon-gama-apis exports getPlugin, which fetches JSON from https://bet.slotgambit.com/icons/111 and passes the response field data.credits directly...
Malicious code in polygon-gamma-apis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49bd3ddb3340e0ef3c76465b6e275d45ddc8eecdbd742747acde8588a2018b4 [email protected] advertises itself as a 'TypeScript SDK for the Polymarket CLOB API' but ships no Polymarket API surface. The exported...
MAL-2026-10147 Malicious code in polygon-gama-apis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0e5efa9d57dae04a6082dfa776d2c2664f3ce5a838ed9cf56f40656937b7e92 polygon-gama-apis exports getPlugin, which fetches JSON from https://bet.slotgambit.com/icons/111 and passes the response field data.credits directly...
MAL-2026-10148 Malicious code in polygon-gamma-apis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49bd3ddb3340e0ef3c76465b6e275d45ddc8eecdbd742747acde8588a2018b4 [email protected] advertises itself as a 'TypeScript SDK for the Polymarket CLOB API' but ships no Polymarket API surface. The exported...
GHSA-CWC9-CP4J-MCVV libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays
Summary gossipsub processes IHAVE and IWANT control messages by iterating every received message ID synchronously before doing anything with the results. There is no cap on how many IDs a single frame may contain. The default LP frame limit is 4MB, which fits roughly 180,000 message IDs. Iteratin...