267298 matches found
CVE-2026-114141
The toml-node TOML parser for Node.js and the browser is vulnerable to a Denial of Service (DoS) attack due to inefficient algorithmic complexity. In versions prior to 5.0.1 , the addTableArray() function in lib/compiler.js fails to prune distinct [[name]] paths, causing it to rescan complete boo...
DRUPAL-CONTRIB-2026-253
This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds. When the input of the node creation form is processed, it makes use of PHP's unserialize function. This...
MAL-2026-18180 Malicious code in pixel-map-testmetest (npm)
pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on npm install: their binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The package.json poses as an npm...
Malicious code in test-brotli2-testmetest (npm)
test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...
Malicious code in test-brotli-testmetest (npm)
test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...
MAL-2026-18181 Malicious code in test-brotli-testmetest (npm)
test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...
MAL-2026-18182 Malicious code in test-brotli2-testmetest (npm)
test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...
EUVD-2026-105135
Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance...
CVE-2026-89802
A flaw was found in the Linux kernel's drm/nouveau/uvmm component. When unwinding an OPMAPSPARSE operation, a NULL pointer dereference can occur if a subsequent operation in the same job fails. This vulnerability can be exploited by a local attacker with access to a render-node file descriptor,...
Drupal Unpublished Node Permissions authorization issue vulnerability
In Drupal Unpublished Node Permissions versions 0.0.0 through 1.8.0, there is an authorization issue vulnerability stemming from improper authorization, which may lead to forced browsing...
Malware in @dreamguyxeon/libsignal-node
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Server-side Request Forgery (SSRF)
Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via server-side self-fetch fallbacks that automatically follow HTTP redirects. SvelteKit makes server-side fallback requests to URLs derived from the incomi...
CLEANSTART-2026-YQ27190 Node
Security vulnerability affects the nodejs-24 package. The Node...
CLEANSTART-2026-RX03118 In all versions of Node
Security vulnerability affects the nodejs-24 package. In all versions of Node...
CLEANSTART-2026-OM41061 Improper Certificate Validation in Node
Security vulnerability affects the nodejs-24 package. Improper Certificate Validation in Node...
0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16553 more potentially affected by CVE-2026-114102 via adm-zip (>=0.1.4, <=0.6.0)
adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-114102 Source advisory: MEND:CVE-2026-114102...
CLEANSTART-2026-BX59752 npm package "tar" (aka node-tar) before versions 4
Security vulnerability affects the nodejs-24 package. The npm package "tar" aka node-tar before versions 4...
CLEANSTART-2026-DX32207 npm package "tar" (aka node-tar) before versions 4
Security vulnerability affects the nodejs-24 package. The npm package "tar" aka node-tar before versions 4...