164 matches found
CVE-2026-73602
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to...
CLSA-2026-1784856185 TuxCare security update for moment (13 CVEs)
TuxCare rebuilt moment to address 13 CVEs. Fixed in 2.0.0-tuxcare.1...
CLSA-2026-1774916720 TuxCare security update for moment (2 CVEs)
TuxCare rebuilt moment to address 2 CVEs. Fixed in 2.24.0-tuxcare.1...
CLSA-2026-1773015256 TuxCare security update for moment-timezone (3 CVEs)
TuxCare rebuilt moment-timezone to address 3 CVEs. Fixed in 0.4.1-tuxcare.1...
CLSA-2026-1773101684 TuxCare security update for moment (3 CVEs)
TuxCare rebuilt moment to address 3 CVEs. Fixed in 2.10.6-tuxcare.1...
MAL-2026-10857 Malicious code in @gocortexio/npmgremlinbox-typosquat-moment (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19008091c460cf10b254f3077108bad3b1c5289e85ae59ba7b873aff7d96866d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
ROOT-APP-NPM-CVE-2022-24785 CVE-2022-24785 in @rootio/moment - Patched by Root
Root has patched CVE-2022-24785 in the @rootio/moment package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-31129 CVE-2022-31129 in @rootio/moment - Patched by Root
Root has patched CVE-2022-31129 in the @rootio/moment package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2016-4055 CVE-2016-4055 in @rootio/moment - Patched by Root
Root has patched CVE-2016-4055 in the @rootio/moment package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2017-18214 CVE-2017-18214 in @rootio/moment - Patched by Root
Root has patched CVE-2017-18214 in the @rootio/moment package for Root:npm. Multiple fixed versions available...
CVE-2026-8885
The DeMomentSomTres Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'callout' shortcode in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on the 'width' and 'align' shortcode attributes...
Astra Linux – Vulnerability in node-moment
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Versions of moment that were affected use an inefficient parsing algorithm. Specifically, the string-to-date parsing method used by moment more precisely, the rfc2822 parsing method, which is used by...
CVE-2026-1516
creationtimestamp| type| source ---|---|--- 2026-04-09 00:35:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizks6xl5325 2026-04-09 12:45:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mj2tm4jzoj2z 2026-04-09 20:00:00+00:00| seen|...
CVE-2026-5649
creationtimestamp| type| source ---|---|--- 2026-04-06 14:48:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitj3dwvaa2o...
CVE-2026-23887
creationtimestamp| type| source ---|---|--- 2026-01-22 02:03:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcy3tkxxgj26...
K000157365: Moment vulnerability CVE-2022-31129
Security Advisory Description moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment more specifically rfc2822 parsing, whi...
Malicious Package
Overview cordova-plugin-globalization.moment is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...
MAL-2025-49253 Malicious code in cordova-plugin-globalization.moment (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 431a9d9edd37d8a5dc80555f3c56e275f5c79162ed66ae419cc7b2450c6ad75c The package cordova-plugin-globalization.moment was found to contain malicious code. Source: ghsa-malware...
Linux Distros Unpatched Vulnerability : CVE-2022-31129
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient...
