73653 matches found
Cross Site Scripting
DOMPurify is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of cross-realm DOM elements in INPLACE mode, where elements from a different window or iframe bypass sanitization, allowing attackers to preserve and execute malicious JavaScript...
BIT-SQLITE-2026-51296
SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information...
CLEANSTART-2026-OO06295 Security fixes in nodejs 14.15.5-r0
Package nodejs version 14.15.5-r0 fixes 1 vulnerabilities: CVE-2021-21148...
ALPINE-CVE-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
CVE-2026-14592
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in...
UBUNTU-CVE-2026-56847
A flaw in Node.js Permission Model enforcement allows traceevents.createTracing.enable Writes Trace Logs Outside --allow-fs-write. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and...
UBUNTU-CVE-2026-56850
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-14207
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...
CVE-2026-56847
A flaw in Node.js Permission Model enforcement allows traceevents.createTracing.enable Writes Trace Logs Outside --allow-fs-write. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and...
CVE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This...
CVE-2026-58040
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...
EUVD-2026-50993
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...
CVE-2026-14207
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...
EUVD-2026-50986
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in...
CVE-2026-14592
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in...
CVE-2026-58040
creationtimestamp| type| source ---|---|--- 2026-07-30 04:46:49+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260730 2026-07-30 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrumtyo7h22j...
CVE-2026-58045
creationtimestamp| type| source ---|---|--- 2026-07-30 04:46:30+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260730 2026-07-30 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrumtyo7h22j...
CVE-2026-58042
creationtimestamp| type| source ---|---|--- 2026-07-30 04:46:27+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260730 2026-07-30 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrumtyo7h22j...
nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw
A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...
