7367 matches found
Malicious Package
Overview vite-linting-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PT-2025-42488
Name of the Vulnerable Software and Affected Versions QuickJS affected versions not specified Description A Use-After-Free UAF condition exists in the QuickJS engine’s standard library when processing unhandled rejected promises. The js std promise rejection check function iterates through the...
PT-2025-42493
Name of the Vulnerable Software and Affected Versions QuickJS affected versions not specified Description A flaw exists in the QuickJS engine’s BigInt string parsing logic within the js bigint from string function when creating a BigInt from a string containing a very large number of digits. The...
tom-microservice (3.2.28) potentially affected by CVE-2025-62380 via mailgen (2.0.20)
mailgen NPM version 2.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on mailgen and may be impacted: - tom-microservice 3.2.28 Source cves: CVE-2025-62380 Source advisory: SNYK:JS-MAILGEN-13559301...
CVE-2025-11160
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes...
CVE-2025-11160 WPBakery Page Builder <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes...
WordPress WPBakery Page Builder plugin <= 8.6.1 - Stored Cross-Site Scripting via Custom JS Module vulnerability
Stored Cross-Site Scripting via Custom JS Module vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin WPBakery Page Builder versions = 8.6.1...
CVE-2025-11160: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS module in all versions up to, and including, 8.6.1. This is due to insufficient input sanitization and output escaping of user-supplied JavaScript code in the Custom JS module. This makes...
PT-2025-42238
Name of the Vulnerable Software and Affected Versions WPBakery Page Builder versions prior to 8.6.1 Description The WPBakery Page Builder plugin for WordPress is affected by a Stored Cross-Site Scripting issue in the Custom JS module. Insufficient input sanitization and output escaping of...
WordPress plugin WPBakery Page Builder has a security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin... A security...
PT-2025-46091
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=451334094 Crash type: Heap-use-after-free READ 8 Crash state: JS DefineProperty build backtrace JS CallInternal...
Parse-SDK-JS security vulnerabilities
Parse-SDK-JS is an open source developer toolkit for the Parse Platform. A security vulnerability exists in Parse-SDK-JS versions prior to 7.0.0 that originates from the injection of a malicious payload and could lead to the remote execution of arbitrary code...
Microsoft Playwright Node.js Package < 1.55.1 Spoofing (CVE-2025-59288)
The version of the Microsoft Playwright Node.js Package installed on the remote host is prior to 1.55.1. It is, therefore, affected by a spoofing vulnerability: - Improper verification of cryptographic signature in GitHub allows an unauthorized attacker to perform spoofing over an adjacent networ...
Prototype Pollution
js-toml is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of user-supplied TOML input during parsing, which allows an attacker to craft malicious TOML data that modifies properties of the global Object.prototype, potentially leading to arbitrary code execution or...
Exploit for Improper Authorization in Vercel Next.Js
CVEs — Exploits/CVE Identifiers Repository A collection of pr...
Happy DOM: VM Context Escape can lead to Remote Code Execution
Escape of VM Context gives access to process level functionality Summary Happy DOM v19 and lower contains a security vulnerability that puts the owner system at the risk of RCE Remote Code Execution attacks. A Node.js VM Context is not an isolated environment, and if the user runs untrusted...
Malicious code in eslint-js-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6662e6d5b878c4eb877089ca5baf3bd40947a9e14dc394e9f11e935facea5b5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview eslint-js-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2025-48291 Malicious code in eslint-js-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6662e6d5b878c4eb877089ca5baf3bd40947a9e14dc394e9f11e935facea5b5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
