Lucene search
+L

61157 matches found

RedHat Linux
RedHat Linux
added 2026/03/12 8:19 a.m.10 views

firefox: thunderbird: Use-after-free in the JavaScript Engine component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine component...

9.8CVSS5.7AI score0.00469EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/03/12 8:19 a.m.10 views

firefox: thunderbird: Use-after-free in the JavaScript Engine component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine component...

9.8CVSS5.7AI score0.00314EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/03/12 8:19 a.m.6 views

firefox: thunderbird: Use-after-free in the JavaScript: GC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...

9.8CVSS5.7AI score0.00477EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/03/12 8:19 a.m.8 views

firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

9.8CVSS5.7AI score0.00469EPSS
SaveExploits1References6
RedHat Linux
RedHat Linux
added 2026/03/12 8:19 a.m.13 views

firefox: thunderbird: Invalid pointer in the JavaScript Engine component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript Engine component...

9.8CVSS5.7AI score0.00366EPSS
SaveExploits0References6
OSV
OSV
added 2026/03/12 3:32 a.m.19 views

CVE-2026-3979 quickjs-ng quickjs quickjs.c js_iterator_concat_return use after free

A flaw has been found in quickjs-ng quickjs up to 0.12.1. This affects the function jsiteratorconcatreturn of the file quickjs.c. This manipulation causes use after free. The attack requires local access. The exploit has been published and may be used. Patch name:...

4.8CVSS5.5AI score
SaveExploits0References10
CVE
CVE
added 2026/03/12 12:32 a.m.19 views

CVE-2026-3968

Summary: CVE-2026-3968 affects AutohomeCorp frostmourne (up to 1.0) via the Oracle Nashorn JavaScript Engine. The vulnerability targets the function scriptEngine.eval in ExpressionRule.java, enabling remote code injection through manipulation of the EXPRESSION argument. Exploitability is indicate...

6.5CVSS5.5AI score0.00228EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/03/12 12:32 a.m.11 views

EUVD-2026-11493

A vulnerability has been found in AutohomeCorp frostmourne up to 1.0. This affects the function scriptEngine.eval of the file ExpressionRule.java of the component Oracle Nashorn JavaScript Engine. Such manipulation of the argument EXPRESSION leads to code injection. The attack can be executed...

6.5CVSS5.5AI score0.00228EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/03/12 12:31 a.m.5 views

EUVD-2026-11444

Out of bounds read in V8 in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Chromium security severity: Medium...

8.8CVSS5.8AI score0.00226EPSS
SaveExploits0References3
BDU FSTEC
BDU FSTEC
added 2026/03/12 12:0 a.m.11 views

The vulnerability of Adobe Experience Manager’s content and media data management system, related to the lack of measures taken to protect the website structure, allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the Adobe Experience Manager content and media data management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code remotely...

5.5CVSS6AI score0.00205EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/03/12 12:0 a.m.10 views

PT-2026-76587

Name of the Vulnerable Software and Affected Versions Trix versions prior to 2.1.17 Description Trix is a what-you-see-is-what-you-get rich text editor. The software is susceptible to cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites, when the...

4.6CVSS5AI score0.00321EPSS
SaveExploits0References9
Packet Storm News
Packet Storm News
added 2026/03/12 12:0 a.m.19 views

Agent Privilege Separation in OpenClaw: A Structural Defense against Prompt Injection

Prompt injection remains one of the most practical attack vectors against LLM-integrated applications. We replicate the Microsoft LLMail-Inject benchmark Greshake et al., 2024 against current generation models running inside OpenClaw, an open source multitool agent platform. Our proposed defense...

5.8AI score
SaveExploits0
Packet Storm News
Packet Storm News
added 2026/03/12 12:0 a.m.44 views

Keys on Doormats: Exposed API Credentials on the Web

Application programming interfaces APIs have become a central part of the modern IT environment, allowing developers to enrich the functionality of applications and interact with third parties such as cloud and payment providers. This interaction often occurs through authentication mechanisms tha...

5.9AI score
SaveExploits0
Packet Storm
Packet Storm
added 2026/03/12 12:0 a.m.251 views

📄 Alipay Open Redirect / API Attacker Payload Insertion

A single crafted URL enables a complete attack chain against Alipay mobile application users that can allow for data exfiltration. As the vendor has stated this is normal behavior with no apparent plans to address the problem, this is being published to make users aware. Alipay Mobile App -...

5.8AI score
SaveExploits0
Packet Storm News
Packet Storm News
added 2026/03/12 12:0 a.m.7 views

AEGIS: No Tool Call Left Unchecked -- a Pre-Execution Firewall and Audit Layer for AI Agents

AI agents increasingly act through external tools: they query databases, execute shell commands, read and write files, and send network requests. Yet in most current agent stacks, model-generated tool calls are handed to the execution layer with no framework-agnostic control point in between...

6AI score
SaveExploits0
RubySec
RubySec
added 2026/03/12 12:0 a.m.5 views

Trix has a Stored XSS vulnerability through serialized attributes

Impact The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker could craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when the content ...

4.6CVSS5.6AI score0.00321EPSS
SaveExploits0References1Affected Software1
Tenable Nessus
Tenable Nessus
added 2026/03/12 12:0 a.m.8 views

RHEL 8 : thunderbird (RHSA-2026:4432)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:4432 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: libvpx: Heap buffer overflow in libvpx CVE-2026-2447 firefox:...

10CVSS6.1AI score0.00604EPSS
SaveExploits2References78
ATTACKERKB
ATTACKERKB
added 2026/03/11 10:58 p.m.7 views

CVE-2026-31988

yauzl aka Yet Another Unzip Library version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate function. The while loop condition checks cursor data.length + 4 instead of cursor + 4 = data.length, allowing readUInt16LE to rea...

6.9CVSS6AI score0.00485EPSS
SaveExploits0References5Affected Software1
Snyk
Snyk
added 2026/03/11 10:40 p.m.3 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the upload of .prologue.html file when a crafted URL is accessed. An attacker can execute arbitrary JavaScript in the context of another user's session by uploading a malicious .prologue.html file and tricki...

4.4CVSS5.7AI score0.00162EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/11 10:16 p.m.10 views

CVE-2026-32117

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign / window.open with no scheme validation. An attacker with dashboard Editor privileges can set the link t...

7.6CVSS0.00265EPSS
SaveExploits0References2
Rows per page
Query Builder