75784 matches found
CVE-2026-59782
A flaw was found in Zabbix. An authenticated user with limited administrative privileges can read raw server memory by leveraging the JavaScript preprocessing engine. This flaw leads to information disclosure, exposing sensitive data from other concurrently running preprocessor tasks that should...
SUSE CVE-2026-104849
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.runtask, options without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications a...
CVE-2026-59788
A flaw was found in Zabbix. The application fails to properly validate the URL scheme of the authorization endpoint in the email media type OAuth form. An attacker can provide a specially crafted configuration file containing a malicious script link. When a privileged administrator attempts to...
TOTOLINK A3002RU Credential Leak (CVE-2018-13317)
Exploits CVE-2018-13317 in TOTOLINK A3002RU 1.0.8: unauthenticated GET to /password.htm exposes plaintext admin username and password in JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """TOTOLINK A3002RU password.htm leak CVE-2018-13317.""" import re from kittysploit import from...
CVE-2026-104872
A flaw was found in OpenTelemetry JavaScript Contrib database instrumentation packages. By default, these packages automatically attach database connection usernames to emitted telemetry traces during database operations without requiring explicit opt-in configuration. This issue allows...
CVE-2026-59788
The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...
DEBIAN-CVE-2026-59782
The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...
CVE-2026-59782
The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...
UBUNTU-CVE-2026-59782
The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...
CVE-2026-59782
The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...
CVE-2026-59788
The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...
CVE-2026-59788 Stored XSS vulnerability in OAuth configuration form
The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...
CVE-2026-59788 Stored XSS vulnerability in OAuth configuration form
The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...
EUVD-2026-92400
The email media type OAuth form passes the Authorization endpoint value to window.open without validating the URL scheme, so a javascript: URL is executed in the browser. This means a crafted media type configuration, deliverable as an import file, runs arbitrary JavaScript as the Super Admin who...
EUVD-2026-92395
The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...
CVE-2026-59782 JavaScript preprocessing memory disclosure
The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...
CVE-2026-59782 JavaScript preprocessing memory disclosure
The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...
CVE-2026-59782
The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulting in leaked data from other running preprocessors not available to said administrator...
K000163541: ip-address library vulnerability CVE-2026-42338
Security Advisory Description ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group and Address6.link do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and...
Malicious code in chai-as-testmode (npm)
Source: amazon-inspector af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2 The package masquerades as the pino logging library README badges and lib/ contents mimic pino but ships a dropper at lib/initializeCaller.js. A self-executing IIFE POSTs the full process.env object to a...