11445 matches found
openclaw
OpenClaw š¦ ā Your assistant, on your devices, in your chats OpenClaw is an open-source AI assistant that runs on your own computer and meets you in the channels you already use: Discord, iMessage, Slack, Teams, Telegram, WhatsApp, and 20+ more, plus native apps for macOS, iOS, Android, Windows, a...
CVE-2025-55130
CVE-2025-55130 - Node.js Permission Model Symlink Escape / | | | | |/ \ / \ | | | | / | // \ | | || | || || || | | | | \ | \ \ | | | | | | |/|| \ ||| ||/||| | || | || | |/ |//||// Node.js Permission Model Bypass via Crafted Symlinks Discovered by natann @ JFrog Overview A path traversal flaw in...
CVE-2017-11499
Vulnerabilidades de seguridad especĆficas de Node.js Semillas constantes de tabla hash CVE-2017-11499 Node.js era susceptible a ataques remotos de denegaciĆ³n de servicio por inundaciĆ³n de hash porque la semilla de la tabla hash era constante en una versiĆ³n publicada de Node.js. Esto fue el...
CVE-2020-8277
CVE-2020-8277 For educational purposes only. Quick Run clone this repository $ git clone https://github.com/masahiro331/CVE-2020-8277 run bind $ docker build -t bind-local ./bind Need TCP fallback $ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind use " v15.2.1" version If you use fixed...
CVE-2023-48223
CVE-2023-48223 PoC ConfusiĆ³n de Algoritmos fast-jwt Este repositorio demuestra la confusiĆ³n de algoritmos JWT en fast-jwt cuando la verificaciĆ³n del token no bloquea los algoritmos permitidos. ConfiguraciĆ³n del Entorno Requisitos Node.js 18 o mĆ”s reciente npm OpenSSL debe estar disponible en tu...
PacketPirate
PacketPirate A headless , scriptable, command-line based MITM proxy designed for network traffic interception, analysis, and modification on Windows systems. It operates similarly to industry-standard GUI proxies but is optimized for automation environments, headless operation, and integration wi...
CVE-2026-88038
A flaw was found in the cookies Node.js library. This vulnerability allows a remote attacker to inject additional cookie attributes into the Set-Cookie header by providing untrusted data to the domain or path options. This occurs because the library's validation for these options is permissive,...
mongo-express Remote Code Execution
mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the toBSON method and misuse the vm dependency to perform exec commands in a non-safe environment. id: CVE-2019-10758 info: name: mongo-express Remote Code Execution author: princechaddha severity: critical...
CVE-2026-105219: Inefficient Regular Expression Complexity
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in...
PT-2026-104648
Name of the Vulnerable Software and Affected Versions Mammoth.js versions 1.3.0 through 1.12.2 Description A regular expression denial of service occurs in the style map tokeniser located in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. An attacker can provide a specially...
MAL-2026-17500 Malicious code in @nagular/router (npm)
@nagular/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...
MAL-2026-17492 Malicious code in @angularr/cli (npm)
@angularr/[email protected] impersonates @angular/cli it copies the code and metadata of @angular/cli, including the ng binary and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...
Exploit for CVE-2026-102282
CVE-2026-102282 ā adm-zip setuid/setgid preservation during ex...
GHSA-GJJ5-9665-RWRC probe-image-size: Quadratic-time Denial of Service in the SVG Parser
Overview probe-image-size scans the SVG header with a searching regular expression, //. On input that contains many , the engine restarts the ^ scan at every position and runs to end of input each time, giving quadratic time complexity. Both the synchronous and the streaming parser are affected...
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...
EUVD-2026-57757
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header...
GHSA-X8MW-P69M-V3MX @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Impact Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named proto or constructor resolves to an inherited value that is not an array, and the parse...
GHSA-XJH9-V7X6-24JW @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...
EUVD-2026-57759
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary...
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...