267296 matches found
PT-2026-120813
Name of the Vulnerable Software and Affected Versions toml-node versions prior to 5.0.1 Description The toml.parse function passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt before the reduceInteger function in lib/compiler.js verifies if the...
PT-2026-120810
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse compiler's addTableArray function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-tables header. Distinct name paths are not pruned, so a document...
PT-2026-120926
This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds. When the input of the node creation form is processed, it makes use of PHP's unserialize function. This...
PT-2026-120812
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign, deepRef, and setNestedKey. The resultin...
Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253
This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds. When the input of the node creation form is processed, it makes use of PHP's unserialize function. This...
PT-2026-120630
A stack overflow in the gf bifs dec node function /bifs/field decode.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...
CVE-2026-106558
A flaw was found in @backstage/plugin-techdocs-node. An authenticated attacker with permissions to register or modify documentation in a source code management SCM repository can bypass configuration sanitization checks. By providing a crafted markdown extension configuration, the attacker can...
GHSA-97WV-P4XX-C7MG ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
Summary The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the...
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
Summary The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the...
Directory Traversal
Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Directory Traversal via the importAnalysisPlugin in packages/vite/src/node/plugins/importAnalysis.ts, where resolved module IDs are registered into safeModulePaths using th...
CVE-2026-112947
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...
CVE-2026-112950
The Vitest testing framework (versions 4.1.11 to 4.1.12 and 5.0.3) is vulnerable to a path traversal flaw on Windows systems. The root cause is an inconsistency in how isFileLoadingAllowed and filesystem read operations interpret backslashes within packages/mocker/src/node/interceptorPlugin.ts. A...
CVE-2026-112950
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...
CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...
CVE-2026-112947
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-93046
A flaw was found in the Linux kernel's software node component. A local attacker could exploit a failing bounds check in the softwarenodegetreferenceargs function when an index of UINTMAX is passed. This could lead to an out-of-bounds access in the property array, potentially resulting in memory...
ROOT-APP-NPM-CVE-2026-44573 CVE-2026-44573 in next - Patched by Root
Root has patched CVE-2026-44573 in the next package for Root:npm. Multiple fixed versions available...
CLEANSTART-2026-AX01759 launch-editor allows users to open files with line numbers in editor from Node
CVE-2026-53632 affects multiple packages. launch-editor allows users to open files with line numbers in editor from Node. See references for individual vulnerability details...
CLEANSTART-2026-ID87281 node-re2 provides RE2 regular expression bindings for Node
CVE-2026-71430 affects multiple packages. node-re2 provides RE2 regular expression bindings for Node. See references for individual vulnerability details...