195888 matches found
CVE-2026-92595
Nodemailer npm package nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent using the documented legacy three-argument signature resolveContentdata,...
CVE-2026-92599
joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...
CVE-2026-92599 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service in the Joi.string.isoDate validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-secon...
CVE-2026-92595
Nodemailer (npm package nodemailer) versions 9.1.0 and earlier fail to honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved via the public plugin API MailMessage.resolveContent() using the legacy three-argument signature. The root cause is that shared....
CVE-2026-92595
Nodemailer npm package nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent using the documented legacy three-argument signature resolveContentdata,...
CVE-2026-29786
CVE-2026-29786 研究： Joshua van Rijswijk 描述 本仓库包含 CVE-2026-29786 的 概念验证（PoC） ，这是 tar npm 包中的一个漏洞，允许特制的归档文件创建指向预期解压目录之外的硬链接 。 当 tar 归档文件包含驱动器相对链接目标 （如 C:../target.txt）时，就会出现此问题。由于库在解压过程中执行验证和路径规范化的顺序问题，遍历保护可以被绕过。 规范化后，路径变为 ../target.txt，从而允许链接目标逃逸出配置的解压目录。 当写入解压后的文件时，外部文件会被修改，因为两个路径引用的是同一个硬链接。 漏洞详情...
deephas-1.0.7-Prototype-Pollution-PoC-CVE-2026-25047-
deephas = 1.0.8 中修复。 参考链接： GitHub 安全公告（GHSA-2733-6c58-pf27） NVD CVE-2026-25047 原始仓库：sharpred/deepHas 环境要求 Python 3.x Node.js（推荐 16 / 18 / 20） 使用 npm 安装存在漏洞的包 安装与使用 1. 克隆本仓库： root@kitploit: git clone https://github.com/your-username/deephas-poc-cve-2026-25047.git cd deephas-poc-cve-2026-25047...
CVE-2025-12758
CVE-2025-12758: Validator.js isLength Unicode Variation Selector バイパス CVE ID: CVE-2025-12758 CVSS スコア: 8.7 HIGH 重要度: HIGH CWE: CWE-792 Incomplete Filtering of One or More Instances of Special Elements 公開日: November 26, 2025 開示日: October 19, 2025 脆弱性の概要 この脆弱性は、validator npm パッケージのバージョン 13.15.22...
NPM: node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
Resource Exhaustion vulnerability discovered by ? in WordPress Npm node-opcua-transport versions = 2.0.0, 2.170.0...
NPM: node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
Resource Exhaustion vulnerability discovered by ? in WordPress Npm node-opcua versions = 2.0.0, 2.170.0...
MAL-2026-16243 Malicious code in idx_form_script (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cc222b7d4398590749d82ffc06100ca629c6e07970a0f95bcf63889fda19cd3 [email protected] is published with an implausibly high version number characteristic of dependency-confusion attacks against private internal...
Malicious code in idx_form_script (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cc222b7d4398590749d82ffc06100ca629c6e07970a0f95bcf63889fda19cd3 [email protected] is published with an implausibly high version number characteristic of dependency-confusion attacks against private internal...
ROOT-APP-NPM-CVE-2026-55388 CVE-2026-55388 in piscina - Patched by Root
Root has patched CVE-2026-55388 in the piscina package for Root:npm. Multiple fixed versions available...
MAL-2026-16222 Malicious code in @traktis/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...
Malicious code in @traktis/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...
CVE-2026-31802
🛡️ CVE-2026-31802 - シンプルな概念実証ビューア 📋 CVE-2026-31802 について このリポジトリは、CVE-2026-31802 の概念実証 PoC と解説を提供します。この問題は npm tar パッケージのセキュリティ脆弱性です。攻撃者はシンボリックリンクとパストラバーサルを悪用して、許可されたフォルダの外部にファイルを書き込むようにソフトウェアを騙すことができます。...
CVE-2026-54519
CVE-2026-54519 ai-agent-automation のメモリAPIにおける所有権チェックの欠如により、ユーザー間をまたいだメモリの読み取りと削除が可能でした。 主なアドバイザリ: GHSA-qv97-83w4-ff86 研究者クレジット: @chaitanyagarware 早見表 フィールド| 値 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project| vmDeshpande/ai-agent-automation Package| backend Ecosystem| npm 深刻度| 高 CVS...
next-picomatch-cve-repro
Next.js 捆绑的 picomatch CVE-2026-33671 复现 针对以下问题的极简复现：Next.js 16.2.4 内置了 picomatch 4.0.3，位于 nodemodules/next/dist/compiled/picomatch/，该版本受 CVE-2026-33671 （高危）影响。npm 的 overrides 无法触及捆绑副本。 步骤 root@kitploit: npm install 1. 检查内置副本 root@kitploit: cat nodemodules/next/dist/compiled/picomatch/package.json...