Lucene search
+L

254851 matches found

RedHat Linux
RedHat Linux
added 12 hours ago2 views

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

8.7CVSS7.1AI score0.00418EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 12 hours ago2 views

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

9.2CVSS7.2AI score0.00424EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 12 hours ago4 views

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

8.7CVSS7.1AI score0.00418EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 12 hours ago4 views

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

9.2CVSS7.2AI score0.00424EPSS
SaveExploits1References7
Nuclei
Nuclei
added 15 hours ago52 views

n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution

n8n versions = 0.123.0 and = 0.123.0 and = 0.123.0 and 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. An authenticated user can exploit the Git node to overwrite critical files and execute untrusted code on the n8n server, potentially leadin...

9.9CVSS9AI score0.05258EPSS
SaveExploits1References2
Nuclei
Nuclei
added 15 hours ago6 views

Flowise < 3.1.2 - node-custom-function Unauthorized RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

9.9CVSS6.6AI score0.03489EPSS
SaveExploits2References3
Nuclei
Nuclei
added 15 hours ago63 views

node-srv - Local File Inclusion

node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a malicious user to read content of any file with known path. id: CVE-2018-3714 info: name: node-srv - Local File Inclusion author: madrobot severity: medium description: node-srv is vulnerable to local fil...

6.5CVSS6.8AI score0.08632EPSS
SaveExploits1References5
Nuclei
Nuclei
added 15 hours ago116 views

Omnia MPX 1.5.0+r1 - Local File Inclusion

Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel. id: CVE-2022-36642 info: name: Omnia MPX 1.5.0+r1 - Local Fi...

9.8CVSS7.7AI score0.09572EPSS
SaveExploits1References4
Nuclei
Nuclei
added 15 hours ago51 views

Mongoose < 8.8.3 - Remote Code Execution

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. id: CVE-2024-53900 info: name: Mongoose 8.8.3 - Remote Code Execution author: h4mg severity: critical description: | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. impact...

9.1CVSS7.9AI score0.03988EPSS
SaveExploits3References5
OSV
OSV
added yesterday8 views

MAL-2026-11430 Malicious code in list-issue-predecessor-dependencies-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f74d699bfc5fcf83c6f2864f93ecd41d3d9f8613f45f6bfb3b6dd5eeb7a880e The OpenSSF Package Analysis project identified 'list-issue-predecessor-dependencies-block' @ 99.0.0 npm as malicious. It is considered maliciou...

5.5AI score
SaveExploits0
OSV
OSV
added 2 days ago5 views

MAL-2026-11427 Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a0cb104ba7e29ae2e20cb4d191f5a1cb0a74de3a26cc06e9e6369d5bbee94e5 The OpenSSF Package Analysis project identified 'pp-react-worldready' @ 1.0.0 npm as malicious. It is considered malicious because: - The packag...

5.4AI score
SaveExploits0
NVD
NVD
added 2 days ago6 views

CVE-2026-67307

Wazuh 5.0.0-beta1 fixed in 5.0.0-beta3 does not validate or override the clustername and clusternode fields in inventory-sync Start FlatBuffer messages, while validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster...

7CVSS0.00169EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2 days ago7 views

CVE-2026-67318

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

6.3CVSS5.6AI score0.00356EPSS
SaveExploits0
OSV
OSV
added 2 days ago5 views

CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

8.3CVSS5.5AI score0.00304EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2 days ago30 views

CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

8.3CVSS0.00304EPSS
SaveExploits0References3
CVE
CVE
added 2 days ago18 views

CVE-2026-67320

CVE-2026-67320 affects axios on Node.js when using the HTTP adapter. A hardened config object can be re-exposed to regular objects via common patterns, allowing an attacker to pollute Object.prototype.proxy and route plaintext-HTTP requests through a malicious proxy. Impact includes exposure of A...

8.3CVSS5.5AI score0.00304EPSS
SaveExploits0References3
OSV
OSV
added 3 days ago3 views

MAL-2026-11455 Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81cc68a7fe1c39ad33325aeb049148b1165f9d8d85c14329094de9912305e325 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.6AI score
SaveExploits0References1
OSV
OSV
added 3 days ago4 views

MAL-2026-11472 Malicious code in mcp-server-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51e3c940b9fc50ad864429da89bf924d2bd1c0253ac8bde66b0b82643260eb51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.6AI score
SaveExploits0References1
OSV
OSV
added 3 days ago3 views

MAL-2026-11458 Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f921c394df64d1bceae64ceeb12704fa1a6bec8e502a93507aae663647af05e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.6AI score
SaveExploits0References1
OSV
OSV
added 3 days ago4 views

MAL-2026-11460 Malicious code in create-remotion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f64eaf9a8b1571d5e5800922eededf88e925355ce9fa4d61c60d8b8c302401b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.6AI score
SaveExploits0References1
Rows per page
Query Builder