CVE-2026-59801 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

CVE-2026-51937

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component...

Malicious Package

Overview @hpcc/js-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2584 Malicious code in @hpcc/js-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66d87d26a2f328414129f2abca4fe30a3f49afcefc1734ff29504b30e8e5e538 The package @hpcc/js-api was found to contain malicious code. Source: ghsa-malware baed13149b187a8ebee8b70891d8c38114a2f8c25e0048e5f2524ae8cb61217e A...

Malicious code in hease-js-api (npm)

The package hease-js-api was found to contain malicious code...

Malicious code in cortex-js-api (npm)

The package cortex-js-api was found to contain malicious code...

Malicious code in rdio-js-api (npm)

The package rdio-js-api was found to contain malicious code...

MAL-2025-17598 Malicious code in cortex-js-api (npm)

The package cortex-js-api was found to contain malicious code...

MAL-2025-22331 Malicious code in hease-js-api (npm)

The package hease-js-api was found to contain malicious code...

ourtunes (>=0.0.0, <=1.1.0), play-url (>=0.0.2, <=0.0.5) potentially affected by unknown CVE via rdio-js-api (0.0.6)

rdio-js-api NPM version 0.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on rdio-js-api and may be impacted: - ourtunes =0.0.0, =0.0.2, =0.0.5 Source cves: unknown CVE Source advisory: OSV:MAL-2025-31754...

MAL-2025-31754 Malicious code in rdio-js-api (npm)

The package rdio-js-api was found to contain malicious code...

CVE-2025-30215

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially expose...

Mail.ru: Eval-based XSS in Game JS API (mailru.core.js) via cross-origin postMessage()

mailru.core.js as used by GMR/store.my.games application was vulnerable to XSS via PostMessage handler...

Google Chrome < 20.0.1132.43 Multiple Vulnerabilities

Binary data 800967.prm...

Buffer overflow

Buffer overflow in the JS API in the PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

CVE-2012-2833: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in the JS API in the PDF functionality in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

PT-2012-4294

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 20.0.1132.43 Description A buffer overflow issue exists in the JS API within the PDF functionality. This could allow remote attackers to cause a denial of service or possibly have other unspecified impacts via...