CVE-2026-0776

CVE-2026-0776 - Élément de chemin de recherche non contrôlé du client Discord Résumé Ce dépôt documente la CVE-2026-0776, un problème d'exécution locale de code affectant le client de bureau Discord sur Windows. La vulnérabilité est liée à un comportement non sécurisé de résolution de modules dan...

cve-2025-55182-react2shell_reproduction

CVE-2025-55182 — React2Shell CVSS 10.0 CRITIQUE | Exécution de code à distance avant authentification dans les composants serveur React Découverte par des acteurs menaçants chinois. Activement exploitée par des groupes APT liés à la Chine. Vue d'ensemble Surnommée « React2Shell » , cette...

PYSEC-2026-2015 vLLM vulnerable to remote code execution via transformers_utils/get_config

Summary vllm has a critical remote code execution vector in a config class named NemotronNanoVLConfig. When vllm loads a model config that contains an automap entry, the config class resolves that mapping with getclassfromdynamicmodule... and immediately instantiates the returned class. This...

JLSEC-2026-657 Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

Summary When Deno was run in BYONM mode nodeModulesDir: "manual", the module resolver did not validate that a package's resolved entrypoint stayed within its nodemodules// directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk,...

GHSA-968W-XFQW-VP9Q Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions

Summary When Deno was run in BYONM mode nodeModulesDir: "manual", the module resolver did not validate that a package's resolved entrypoint stayed within its nodemodules// directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk,...

Malicious code in ort-type-test-module-resolution (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-41589 Malicious code in ort-type-test-module-resolution (npm)

--- -= Per source details. Do not edit below this line.=-...

Security Bulletin: Potential module resolution error in DataPower Operator

Summary IBM has addressed a potential build-time issue. This did not affect product code, but may have been detected in customer scans. Vulnerability Details CVEID:CVE-2022-23773 DESCRIPTION: An unspecified error with not treating branches with semantic-version names as releases in cmd/go in Gola...