62358 matches found
@0xgg/echomd (>=1.0.2, <=1.0.4), @ajuhos/malloy-tests (>=0.0.332, <=0.0.334) +176 more potentially affected by CVE-2025-59840 via vega-expression (>=5.0.1, <=5.1.2)
vega-expression NPM version =5.0.1, =1.0.2, =0.0.332, =0.0.332, =1.1.5, =0.4.1-canary.195, =0.1.0, =3.0.0-alpha.2, =0.0.2, =0.0.1, =0.0.5, =0.0.1, =0.0.8 and more Source cves: CVE-2025-59840 Source advisory: OSV:GHSA-7F2V-3QQ3-VVJF...
Uncontrolled Search Path Element
Overview aws-advanced-nodejs-wrapper is a Affected versions of this package are vulnerable to Uncontrolled Search Path Element due to unqualified SQL function and operator references in the database dialect components. An attacker can execute malicious code with elevated privileges by creating...
AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance
Description of Vulnerability: An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rdssuperuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service RDS...
UBUNTU-CVE-2025-59840
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. They...
EUVD-2025-26604
This CVE ID was assigned in error to a vulnerability that was both introduced and fixed before the code landed in the Stable channel of Chrome, and has been withdrawn...
Prototype Pollution
Overview org.webjars.bowergithub.nodeca:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Prototype Pollution via the merge function. An attacker can alter object prototypes by supplying specially crafted YAML documents containing proto...
Prototype Pollution
Overview org.webjars:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Prototype Pollution via the merge function. An attacker can alter object prototypes by supplying specially crafted YAML documents containing proto properties. This can...
CVE-2025-64718
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...
CVE-2025-64718 js-yaml has prototype pollution in merge (<<)
js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...
firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript: WebAssembly component...
firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript: WebAssembly component...
EUVD-2025-178068
Malicious code in lint-staged-javascript-jwt-zooarchaeology npm...
EUVD-2025-178247
Malicious code in juno-ichnology-dotenv-safe-javascript npm...
EUVD-2025-175852
Malicious code in uglify-js-buffer-exosphere-soap npm...
EUVD-2025-176893
Malicious code in puppeteer-module-sails-nextjs npm...
EUVD-2025-176561
Malicious code in sagitta-javascript-process-telesto npm...
EUVD-2025-177595
Malicious code in nightwatch-javascript-kastra-antares npm...
EUVD-2025-177298
Malicious code in passport-wasat-javascript-link npm...