4383 matches found
EUVD-2026-34162
Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data...
CVE-2026-8876
Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.43 security and extras update
Red Hat OpenShift Container Platform release 4.18.43 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of...
JS Help Desk <= 2.8.1 - SQL Injection
The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...
Mongoose < 8.8.3 - Remote Code Execution
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. id: CVE-2024-53900 info: name: Mongoose 8.8.3 - Remote Code Execution author: h4mg severity: critical description: | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. impact...
JS Help Desk <= 2.8.2 - SQL Injection
JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication. id:...
Linux Distros Unpatched Vulnerability : CVE-2026-44574
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect...
Linux Distros Unpatched Vulnerability : CVE-2026-44578
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in...
Security Bulletin: Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
Summary Security Vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access Vulnerability Details CVEID:CVE-2025-12635 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected ...
Malicious code in js-shared-modules (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis adff3edac3c3ba1c04ba273f77d51c95d153b4e027ec4809b3d2f3c74a712a92 The OpenSSF Package Analysis project identified 'js-shared-modules' @ 1.11.7 npm as malicious. It is considered malicious because: - The package...
MAL-2026-5098 Malicious code in js-shared-modules (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis adff3edac3c3ba1c04ba273f77d51c95d153b4e027ec4809b3d2f3c74a712a92 The OpenSSF Package Analysis project identified 'js-shared-modules' @ 1.11.7 npm as malicious. It is considered malicious because: - The package...
Exploit for CVE-2025-66478
CVE-2025-66478-Research-Proof-of-Concept Overview This re...
Malicious Package
Overview zod-to-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
CVE-2026-43898
CVE-2026-43898 affects SandboxJS. Before version 0.9.6, sandboxed functions could access the host runtime via Function.caller, leaking the internal LispType.Call callback and enabling sandbox escapes that allow execution of arbitrary host JavaScript. The root cause is leakage through sandboxed fu...
CVE-2026-42280
Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. This vulnerability is fixed in 10.0.0...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.32 security and extras update
Red Hat OpenShift Container Platform release 4.19.32 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...
MAL-2026-4827 Malicious code in unleash-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d00549f2feef5f3af06b3625effca261dd2be514ae05dc1b21c60e3cb9d1b23b The OpenSSF Package Analysis project identified 'unleash-js' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...
Malicious code in unleash-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d00549f2feef5f3af06b3625effca261dd2be514ae05dc1b21c60e3cb9d1b23b The OpenSSF Package Analysis project identified 'unleash-js' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...
CVE-2026-9520
A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx of the component Sign-in. This manipulation of the argument Next causes cross site scripting. It is possible ...
EUVD-2026-31781
A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx of the component Sign-in. This manipulation of the argument Next causes cross site scripting. It is possible ...