7038 matches found
Exploit for Server-Side Request Forgery in Vercel Next.Js
╔═══════════════════════════════════════════════════════════...
CVE-2026-38728
An issue in Nodemailer smtpserver before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream.write, lib/smtp-stream.js components...
Fedora 44 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-094eb13bb1)
The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-094eb13bb1 advisory. nginx-mod-fancyindex: - Rebuild for 1.30.1 nginx-mod-headers-more: - Rebuild for 1.30.1 nginx-mod-naxsi: - Rebuild for 1.30.1 nginx-mod-js-challenge...
Siemens Teamcenter PDF.js Arbitrary Code Execution (SSA-827383)
The version of Siemens Teamcenter installed on the remote host is affected by a vulnerability: - A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. CVE-2024-4367 Note that Nessus has not tested for this issue but has...
CVE-2026-44670
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View AV / database names without any HTML escape, then a render template uses raw strings.ReplaceAlltpl, "$avName", nodeAvName to embed the name in HTML before pushing to all clients via...
Cross-site Scripting (XSS)
Overview ethyca-fides is an Open-source ecosystem for data privacy as code. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the fides.js script's override mechanism for the banner description field when HTML-formatted descriptions are enabled. An attacker can...
CVE-2026-44482
CVE-2026-44482 affects the SoundCloud Client app (soundcloud-rpc) built on Electron. Before 0.1.8, a track title could contain an HTML payload that, via the preload API window.soundcloudAPI.sendTrackUpdate and IPC to the Electron main process, is rendered as raw HTML in privileged views with Node...
WS-2019-0477
Slush-fullstack-framework v0.9.2 contains malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...
WS-2019-0456
Ng-ui-library v1.0.987 contains malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...
WS-2019-0457
Ngx-context-menu v0.0.26 contains malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...
WS-2019-0437
All versions of js-base64-int contains malicious code. The package uploaded system information such as OS and hostname to a remote server...
WS-2019-0438
All versions of js-regular contains malicious code. The package uploaded system information such as OS and hostname to a remote server...
WS-2019-0432
Grunt-radical, version 0.0.14 contains malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...
WS-2019-0413
crpyto-js was designed to find and exfiltrate cryptocurrency wallets...
WS-2019-0406
cage-js contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script...
WS-2019-0389
Angular-location-update, version 0.0.3 contains malicious code that gets executed in the browser and enumerates password, cvc and cardnumber fields from forms and sends the extracted values to "hps://js-metrics.com/minjs.php?pl="...
WS-2019-0386
@fangrong/xoc version 1.0.6 contains malicious code which steals sensitive information such as cardnumbers and passwords from forms in the browser and send them to "hps://js-metrics.com/minjs.php?pl="...
WS-2018-0625
The package xmlbuilder-js before 9.0.5 is vulnerable to denial of service due to a regular expression issue...