CVE-2025-63700

CVE-2025-63700 Обход аутентификации OAuth в Clerk-js 5.88.0 Затронутый продукт Поставщик : Clerk Inc. clerk.dev / clerk.com Продукт : Clerk-js @clerk/clerk-js Затронутая версия : 5.88.0 Воздействие : Обход аутентификации OAuth CWE-290 : Обход аутентификации путем подмены Автор уязвимости Hasnat...

sockjs-dos-py

CVE-2020-7693: Meteor Демонстрационное приложение Meteor, работающее с уязвимой версией sockjs, включено. Чтобы протестировать эксплойт на этом демонстрационном приложении, установите Meteor с сайта https://www.meteor.com/install, а затем: cd demo/ meteor Затем укажите цель полезной нагрузки как...

ROOT-APP-NPM-CVE-2024-37168 CVE-2024-37168 in @grpc/grpc-js - Patched by Root

Root has patched CVE-2024-37168 in the @grpc/grpc-js package for Root:npm. Multiple fixed versions available...

CLEANSTART-2026-VU21760 source-map-js through 1

Security vulnerability affects the langfuse-worker package. source-map-js through 1...

CLEANSTART-2026-FF43574 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

CVE-2026-32289 affects multiple packages. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. See references for individual vulnerability details...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (September 2026 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-59869 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From...

Security Bulletin:Prototype Pollution Vulnerability in js-yaml Before 4.1.1 and 3.14.2

Summary js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is...

CVE-2022-44318

CVE-2022-44318 설명 PicoC 버전 3.2.2는 ExpressionParseFunctionCall에서 호출할 때 cstdlib/string.c의 StringStrcat 함수에 힙 버퍼 오버플로우가 포함된 것으로 발견되었습니다. Picoc를 사용하는 모든 프로젝트나 라이브러리도 이 문제의 영향을 받습니다. 예를 들어 picoc-js가 있습니다. 환경 설정 PicoC에서 힙 오버플로우 취약점을 재현하려면 먼저 취약한 버전v3.2.2의 PicoC 라이브러리와 인터프리터를 다운로드하여 컴파일해야 합니다: git clone...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.50 security and extras update

Red Hat OpenShift Container Platform release 4.19.50 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...

Masscan-Report

Генератор отчетов Masscan Инструмент на Python, который создает интерактивные HTML-визуализации на основе React из выходных данных masscan в формате JSON, используя силовой граф D3.js. Скриншот Возможности Интерактивный граф сети Силовой граф на D3.js — отображает топологию сети Иерархическая...

CVE-2026-40579

참고 자료 https://github.com/steveukx/git-js/security/advisories/GHSA-mr9g-9pv2-x45j https://vulners.com/cve/CVE-2026-40579...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.36 security and extras update

Red Hat OpenShift Container Platform release 4.21.36 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

CLEANSTART-2026-GZ31996 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Security vulnerability affects the temporal-server package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...

weakrng-sweep

weak-rng スイープ（CVE-2026-71851 クラス） 調査ツール：PRNG スキーム × uint32 シードを列挙し、BIP39 ウォレットを導出し、 被害者アドレス集合に対するメンバーシップをチェックします（防御的調査、illbloom スタイル）。 スキーム：0-10（illbloom：MT19937/glibc/Java/LCG/xorshift）、11-13（glibc-31 LCG）、 14-15（crypto-js 3.3.0 WordArray.random MWC 移植版、node とのバイト検証済み）。 実行方法：Actions - mwc-sweep ...

CVE-2025-44998

CVE-2025-44998 Краткое описание Хранимая XSS-уязвимость межсайтовый скриптинг в компоненте /tinyfilemanager.php TinyFileManager v2.4.7 позволяет злоумышленникам выполнять произвольный JavaScript или HTML путем внедрения специально созданной полезной нагрузки в параметр js-theme-3. PoC Чтобы...

PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Impact . and are not word delimiters in the tokenizer, so a flat selector such as .a.a.a... reaches splitWord as a single word token carrying n class or id indexes. Three passes scanned those index arrays linearly for every index, making the parse On^2 in the number of indexes rather than in inpu...

GHSA-RJ75-HQRM-R3GF PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

Impact . and are not word delimiters in the tokenizer, so a flat selector such as .a.a.a... reaches splitWord as a single word token carrying n class or id indexes. Three passes scanned those index arrays linearly for every index, making the parse On^2 in the number of indexes rather than in inpu...

ProseMirror has a XSS vulnerability in prosemirror-view's paste handling

Impact When a user pastes attacker-provided HTML into a ProseMirror editor component, this can cause attacker-controlled JavaScript code to run in the browser window containing the editor. Patches Version 1.42.3 adds validation that prevents this attack. Workarounds No known workarounds...

CVE-2026-6307

CVE-2026-6307: Путаница типов V8 JS-to-Wasm → RCE на Chrome 146 Локальное воспроизведение и эксплуатация путаницы типов при деоптимизации V8 JS-to-Wasm, описанной Nebula, доведённая до запуска xcalc из рендерера Chrome for Testing 146.0.7680.165 ошибка исправлена в 147.0.7727.101. Все полезные...

CVE-2024-1939

CVE-2024-1939 이 글은 CVE-2024-1939에 대한 짧은 분석 글입니다. V8CTF M122를 클레임하는 데 사용했던 취약점입니다. 이 이슈의 근본 원인은 wasm-to-js 변환에서 kWasmS128에 대한 지원이 부족하다는 점입니다. 구체적으로, 매개변수 스택에서 발생하는 wasmS128Const 연산이 무시되어, 매개변수에 ExprRef가 존재할 때 유형 혼동type confusion이 발생합니다. 자세히 설명하면, 이로 인해 int/float가 직접 객체로 변환됩니다. 따라서 임의 길이를 가진 가짜 배열을...