Lucene search
+L

255449 matches found

OSV
OSV
added 2026/07/14 11:41 p.m.13 views

MAL-2026-10650 Malicious code in install-skia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

6.1AI score
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/07/14 11:39 p.m.14 views

perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names

A flaw was found in XML::LibXML for Perl. A remote attacker could exploit this vulnerability when processing specially crafted XML node names containing incomplete UTF-8 character sequences. This can lead to an out-of-bounds read in heap memory, potentially causing the application to crash and...

7.5CVSS6AI score0.00629EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/14 11:39 p.m.7 views

Important: Red Hat Security Advisory: perl-XML-LibXML security update

An update for perl-XML-LibXML is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

7.5CVSS6.1AI score0.00629EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/14 8:36 p.m.8 views

CVE-2026-48758 sigstore-js: DSSE payloadType type-binding failure

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature...

5.4CVSS6.1AI score
SaveExploits0References6
OSV
OSV
added 2026/07/14 8:33 p.m.10 views

MAL-2026-10621 Malicious code in chai-as-hardened (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20c6afe564cf46f02258e635c1b08a802cd4f9b949e098710f44544cdbb86dfd On require, index.js spawns a detached Node child process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL...

6.2AI score
SaveExploits0References1
OSV
OSV
added 2026/07/14 8:29 p.m.11 views

MAL-2026-10623 Malicious code in http-ws-listener (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b70acc8a626218c5855ef656a6945f1f2018c0ff62c112d9b31bae5016fae49 [email protected] ships misc/configFetcher.js, which reconstructs a hidden Pastebin URL and the module names 'net' and 'childprocess' by...

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 7:55 p.m.23 views

Malicious code in ethereum-lib-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58bddf420dcb894a940b62fba777628f0c3a9d31dd7fa915afaea618c1914d52 Package [email protected] impersonates the widely-used ethereumjs-util library: the package name, README badge, repository, homepage, and auth...

6.2AI score
SaveExploits0References2
OSV
OSV
added 2026/07/14 7:55 p.m.13 views

MAL-2026-10613 Malicious code in ethereum-lib-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58bddf420dcb894a940b62fba777628f0c3a9d31dd7fa915afaea618c1914d52 Package [email protected] impersonates the widely-used ethereumjs-util library: the package name, README badge, repository, homepage, and auth...

6.2AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 7:53 p.m.26 views

Malicious code in assertion-utils-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311d22d9694863456136cf4f8b69a291fdbb631eda56bafca1959e0c184774a1 assertion-utils-js is a typosquat of chai name, description, and keywords mirror the real package. On require, index.js spawns a detached Node child...

6.2AI score
SaveExploits0References2
OSV
OSV
added 2026/07/14 7:53 p.m.11 views

MAL-2026-10612 Malicious code in assertion-utils-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311d22d9694863456136cf4f8b69a291fdbb631eda56bafca1959e0c184774a1 assertion-utils-js is a typosquat of chai name, description, and keywords mirror the real package. On require, index.js spawns a detached Node child...

6.2AI score
SaveExploits0References2
OSV
OSV
added 2026/07/14 5:56 p.m.10 views

MAL-2026-10609 Malicious code in utils-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 5:54 p.m.27 views

Malicious code in chain-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb94ce743d92fe81015db70380ba325e78e4271b78689a9a6998cda4e6bdc038 chain-sdk-js is a typosquat of @thetalabs/theta-js package name, description, author 'Theta Labs', and bundle filenames thetajs.cjs.js/thetajs.umd.js...

6.2AI score
SaveExploits0References6
OSV
OSV
added 2026/07/14 5:53 p.m.8 views

MAL-2026-10607 Malicious code in chai-as-act (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf85a5e85f183a28cc32ff39ddcc68ef15b698cc62eccfaa89dd1bb80c709f6 The package masquerades as a chai plugin but ships the pino logger source tree plus an additional payload file lib/initializeCaller.js. That file is ...

6.2AI score
SaveExploits0References1
NVD
NVD
added 2026/07/14 4:16 p.m.10 views

CVE-2026-11403

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm NuGet API Key, Docker Bearer Token, or npm Bearer Token must be enabled an...

8.7CVSS0.00349EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/14 3:17 p.m.11 views

CVE-2026-58478

Sustainable Irrigation Platform SIP through version 5.2.16 contains a server-side request forgery SSRF vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attacke...

6.5CVSS0.00261EPSS
SaveExploits2References2
Cvelist
Cvelist
added 2026/07/14 3:15 p.m.35 views

CVE-2026-15697 svgdotjs svg.js npm Package API EventTarget.on prototype pollution

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated...

6.5CVSS0.0033EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/14 2:41 p.m.27 views

CVE-2026-58478

SIP 5.2.16 has a server-side request forgery (SSRF) vulnerability when the optional Node-RED plugin is installed. An unauthenticated attacker can supply a malicious callback URL and cause the device to issue arbitrary HTTP requests due to lack of destination validation, aided by the default passp...

6.5CVSS6.2AI score0.00261EPSS
SaveExploits2References2Affected Software1
Cvelist
Cvelist
added 2026/07/14 2:41 p.m.37 views

CVE-2026-58478 Sustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URL

Sustainable Irrigation Platform SIP through version 5.2.16 contains a server-side request forgery SSRF vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attacke...

6.5CVSS0.00261EPSS
SaveExploits2References2
Chainguard
Chainguard
added 2026/07/14 2:17 p.m.27 views

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: code-server, sqlpad, prism, wazuh-dashboard-fips, kibana, lerna, gitlab-rails-ce-fips, opensearch-dashboards-fips, wazuh-dashboard, pulumi, gitlab-rails-ce, npm, kubeflow-centraldashboard, graalvm, saf, opensearch-dashboards, actions-runner...

5.3CVSS5.1AI score0.00292EPSS
SaveExploits0
Chainguard
Chainguard
added 2026/07/14 2:17 p.m.29 views

CVE-2026-59874 vulnerabilities

Vulnerabilities for packages: code-server, sqlpad, homepage, prism, kibana, lerna, gitlab-rails-ce-fips, opensearch-dashboards-fips, wazuh-dashboard, pulumi, wazuh-dashboard-fips, gitlab-rails-ce, npm, kubeflow-centraldashboard, graalvm, saf, opensearch-dashboards, actions-runner...

8.7CVSS7.2AI score0.00418EPSS
SaveExploits1
Rows per page
Query Builder