Lucene search
+L

255604 matches found

RedHat Linux
RedHat Linux
added 2026/07/28 5:31 p.m.8 views

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

8.7CVSS7AI score0.00418EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 2026/07/28 5:31 p.m.20 views

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

9.2CVSS7.1AI score0.00424EPSS
SaveExploits1References7
SUSE CVE
SUSE CVE
added 2026/07/28 5:12 p.m.8 views

SUSE CVE-2026-55968

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

8.7CVSS5.8AI score0.01097EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/07/28 3:59 p.m.10 views

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

8.7CVSS7AI score0.00418EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 2026/07/28 3:59 p.m.10 views

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

9.2CVSS7.1AI score0.00424EPSS
SaveExploits1References7
NVD
NVD
added 2026/07/28 2:16 p.m.11 views

CVE-2026-66922

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

5.1CVSS0.00284EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/28 2:16 p.m.10 views

CVE-2026-66921

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...

6.3CVSS0.00277EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/28 1:41 p.m.14 views

MAL-2026-11132 Malicious code in bianira-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...

6.5AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/28 1:38 p.m.24 views

Malicious code in blots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847ba592915f4561a16225808a93d2428bc12305dc3df0bbf5316bf5a5bd7518 package.json defines preinstall and postinstall lifecycle scripts that unconditionally run curl against a hardcoded webhook.site endpoint, transmitti...

5.5AI score
SaveExploits0References2
OSV
OSV
added 2026/07/28 1:36 p.m.7 views

MAL-2026-11146 Malicious code in sigchain-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 034ba6bdd11139e40b062606dfa180a60727249035899eded96d34797b63a026 The published dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js contain top-level code that reads an encrypted...

6.5AI score
SaveExploits0References2
OSV
OSV
added 2026/07/28 1:35 p.m.9 views

MAL-2026-11142 Malicious code in node-array-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1ce58719e0587902be3a6436f329ce631317fe3a7c322d89f9c679cd6e1a744 index.js is heavily obfuscated with a 312-entry rotated string array plus RC4/base64 decoders that hide identifiers and literals. On require, the...

6.2AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/28 1:33 p.m.19 views

Malicious code in parallely (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a862cdceb2998828aba8de0d4a672b86a2c22dff073356e5acd89e894aced56 The npm package name parallely typosquats concurrently: package.json advertises the concurrently repository, author, and funding while shipping...

5.5AI score
SaveExploits0References2
OSV
OSV
added 2026/07/28 1:32 p.m.6 views

MAL-2026-11131 Malicious code in basic-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab736217e52ecd2e4aa966da6192e434d69f7d34cc5b7a1ce72c6c6ece6aff56 package.json declares preinstall: node index.js, so npm install basic-vite auto-executes index.js. The script collects host identity data hostname,...

5.8AI score
SaveExploits0References1
OSV
OSV
added 2026/07/28 1:30 p.m.8 views

MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1 The @yancyyu/agentcli package installs a telemetry worker dist/telemetry-worker.bundle.mjs that is started by agentcli init / agentcli usage start an...

5.6AI score
SaveExploits0References27
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/28 1:26 p.m.12 views

Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

6.1AI score
SaveExploits0References6
OSV
OSV
added 2026/07/28 1:26 p.m.8 views

MAL-2026-11133 Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

6.1AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/07/28 1:20 p.m.9 views

CVE-2026-66922

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

5.1CVSS5.9AI score0.00284EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/28 1:19 p.m.7 views

CVE-2026-66919

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers. An attacker able to supply or modify graph data could insert a malicious...

6.9CVSS0.00262EPSS
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/28 1:15 p.m.18 views

Malicious code in toll_free (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80914891625809e622f8383e3d7f39792cc850a57dba2d68f831ada91cfd5871 package.json defines both preinstall and postinstall lifecycle scripts that run curl against a hardcoded webhook.site endpoint, sending the installer...

5.7AI score
SaveExploits0References1
EUVD
EUVD
added 2026/07/28 1:5 p.m.6 views

EUVD-2026-49844

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...

6.3CVSS6.1AI score0.00277EPSS
SaveExploits0References1
Rows per page
Query Builder