CVE-2024-27088

CVE-2024-27088 Panoramica della vulnerabilità CVE-2024-27088 26 Feb 2024 ReDoS nel pacchetto node.js Parte del progetto rebob Descrizione della vulnerabilità github advisories root@kitploit: /^\sfunction\s\0-'-\uffff+\s\0--\uffff\s/ Questa vulnerabilità può essere sfruttata quando c'è uno...

gattacker

Un pacchetto Node.js per Man-in-the-Middle BLE Bluetooth Low Energy e altro. Prerequisiti vedi: https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno Installazione root@kitploit: npm install gattacker Utilizzo Configurazione Per eseguire entrambi i componenti, imposta le...

CVE-2026-73566

creationtimestamp| type| source ---|---|--- 2026-08-21 20:35:04+00:00| published-proof-of-concept| https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m 2026-08-22 12:00:51+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mtoa2m3bdg2n...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the run method in the CSVAgents class. An attacker can execute arbitrary code in the context of the server process by sending crafted prompts to a chatflow using the CSV Agent...

CVE-2026-44705

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences e.g., ....

CVE-2026-21710 vulnerabilities

Vulnerabilities for packages: nodejs...

GHSA-G4W6-C99W-4WH7 BrowserStack Local vulnerable to Command Injection through logfile variable

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js...

Linux Distros Unpatched Vulnerability : CVE-2026-22036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize...

CVE-2020-24660

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package...

EUVD-2025-112795

Malicious code in hermes-gacrux-meissa-cordelia npm...

EUVD-2025-113242

Malicious code in geckodriver-kastra-public-deneb npm...

EUVD-2025-69814

Malicious code in influentiallocustz3n npm...

EUVD-2025-71008

Malicious code in colouredcrayfishz3n npm...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses multer-1.4.5-lts.2.tgz which is vulnerable to CVE-2025-47935.

Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses multer-1.4.5-lts.2.tgz which is vulnerable to CVE-2025-47935. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-47935 DESCRIPTION: Multer is a node.js...

EUVD-2022-5987

Malicious code in bioql PyPI...

EUVD-2024-0870

Malicious code in bioql PyPI...

EUVD-2022-6318

Malicious code in bioql PyPI...

Malicious code in duckdb (npm)

The DuckDB Node.js package duckdb version 1.3.3 was compromised with malware through a sophisticated phishing attack targeting the DuckDB maintainers. An attacker created a pixel-perfect copy of the npmjs.com website at npmjs.help domain and tricked a maintainer into logging in and resetting 2FA...

Linux Distros Unpatched Vulnerability : CVE-2021-31597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but ...

CVE-2024-28607

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable via a falsy isPrivate return value...