267859 matches found
📄 Docmost Cross Site Scripting
Docmost versions prior to 0.71.0 suffer from a persistent cross site scripting vulnerability. CVE-2026-34212 Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin. Intro I...
CVE-2026-54353: Time-of-check Time-of-use (TOCTOU) Race Condition
Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is sent, but the actual socket connectio...
SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:2633-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2633-1 advisory. This update for nodejs24 fixes the following issues Update to 24.17.0: - CVE-2026-2581: undici: Undici: Denial of Service due to...
nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch
A flaw was found in Node.js. This flaw involves a mismatch in how Node.js handles TLS Transport Layer Security hostnames and unicode dot separators during authentication. This mismatch can lead to a wildcard-depth authentication bypass. An attacker could exploit this to bypass intended security...
GO-2026-5653 kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.com/cloudnativelabs/kube-router
kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.com/cloudnativelabs/kube-router...
GO-2026-5628 Klever-Go KVM: Unauthenticated remote node crash (nil-pointer DoS) in klever-go P2P transaction interceptor (txVersionChecker nil RawData) - potential chain halt in github.com/klever-io/klever-go
Klever-Go KVM: Unauthenticated remote node crash nil-pointer DoS in klever-go P2P transaction interceptor txVersionChecker nil RawData - potential chain halt in github.com/klever-io/klever-go...
MAL-2026-6480 Malicious code in gx-npm-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e919710d2f28ec776b8165821ebe2fbe480c1e432ec9416c7b73bd1315ee6a6e Package published at version 99.99.99 under a generic name gx-npm-lib — the canonical dependency-confusion shape used to overshadow internal packages...
Malicious code in gx-npm-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e919710d2f28ec776b8165821ebe2fbe480c1e432ec9416c7b73bd1315ee6a6e Package published at version 99.99.99 under a generic name gx-npm-lib — the canonical dependency-confusion shape used to overshadow internal packages...
Malicious code in velocityfix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c937a54c3629f80fb7b92fbdafda502706b6028b43bc4675eb30c55d9bc059e9 Package masquerades as 'Performance fixes for Minecraft Velocity proxy' authored by 'Velocity Team' — Velocity is a Java project from PaperMC and has...
MAL-2026-6487 Malicious code in velocityfix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c937a54c3629f80fb7b92fbdafda502706b6028b43bc4675eb30c55d9bc059e9 Package masquerades as 'Performance fixes for Minecraft Velocity proxy' authored by 'Velocity Team' — Velocity is a Java project from PaperMC and has...
Malicious code in log-update-ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dbad34a92b1a5080681d7966e3c807324847605ee60f874076b85e336860def Package masquerades as Sindre Sorhus's popular 'log-update' library matching name and description claiming 'Log by overwriting the previous output in...
CVE-2025-71336
Flowise before 3.0.6 affected versions 2.2.7-patch.1 and earlier contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal...
Malicious code in starship-timeline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4e552337fa70064e0a04644ee5a64378809a85b281eda24707bc9a6eba473f [email protected] ships no real functionality. Its package.json declares a preinstall hook "preinstall": "node index.js" that runs automaticall...
MAL-2026-6485 Malicious code in starship-timeline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4e552337fa70064e0a04644ee5a64378809a85b281eda24707bc9a6eba473f [email protected] ships no real functionality. Its package.json declares a preinstall hook "preinstall": "node index.js" that runs automaticall...
Malicious code in runtimekit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa393dec171ebd22b63776d7550006d3f9f60ad8726ce1153784080e9038acd lib/index.cjs and lib/index.mjs re-required from lib/readonly.cjs contain a self-executing IIFE that decodes two opaque strings via a custom shuffle...
MAL-2026-6477 Malicious code in runtimekit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa393dec171ebd22b63776d7550006d3f9f60ad8726ce1153784080e9038acd lib/index.cjs and lib/index.mjs re-required from lib/readonly.cjs contain a self-executing IIFE that decodes two opaque strings via a custom shuffle...
CVE-2025-71336 Flowise - Unsandboxed Remote Code Execution via Custom MCP
Flowise before 3.0.6 affected versions 2.2.7-patch.1 and earlier contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal...
CVE-2025-71336
Flowise vulnerability: Unsandboxed remote code execution in Custom MCP. Affected: Flowise before 3.0.6 (2.2.7-patch.1 and earlier). Attack requires crafting a JSON payload and header x-request-from: internal to /api/v1/node-load-method/customMCP, taking advantage of minimal auth to execute OS com...
Malicious code in typedecode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 593662d3b4cda901642b713f419417807a33f3dca74e818f66e8d0cf9ebcf6e3 On require'typedecode' / import 'typedecode', the bundled dist/index.cjs and dist/index.js execute an obfuscated import-time payload. A bootstrap.js...
Malicious code in tailwind-color-shades (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd681005962f5628f4394450bae9430992e58159e3256bb4af2bc156c5c1fc5 The package's documented entry point index.ts begins with import './src/bootstrap';, which causes src/bootstrap.js to run whenever the module is...