629301 matches found
NPM: Colord: Slow rejection of oversized malformed color strings
NPM: Colord: Slow rejection of oversized malformed color strings vulnerability discovered by ? in WordPress Npm colord versions 2.9.4...
NPM: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
NPM: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers vulnerability discovered by ? in WordPress Npm next versions = 13.4.0, 15.5.24...
NPM: joi: object().rename() with a template target can set the validated object's prototype
NPM: joi: object.rename with a template target can set the validated object's prototype vulnerability discovered by ? in WordPress Npm joi versions = 16.0.0, 17.13.5...
NPM: MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
NPM: MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize via Live NamedNodeMap Removal Skip vulnerability discovered by ? in WordPress Npm maplibre-gl versions = 6.4.0...
NPM: xmldom: Element name injection via createElement() bypasses requireWellFormed
NPM: xmldom: Element name injection via createElement bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.Build.Tasks.Git and Microsoft.SourceLink.AzureRepos.Git. This advisory also provides guidance on what developers can do to update their applications to remove this...
MAL-2026-16048 Malicious code in punypump (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f The package presents itself as a console shim index.js is a verbatim copy of console-browserify with description 'Emulate console for all the...
Malicious code in punypump (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f The package presents itself as a console shim index.js is a verbatim copy of console-browserify with description 'Emulate console for all the...
CLSA-2026-1788892753 TuxCare security update for 3 packages (1 CVE)
TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 0.26.1-tuxcare.3...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
NPM: LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
NPM: LiquidJS: Uncontrolled Resource Consumption in join filter allows template authors to bypass memoryLimit and crash the process vulnerability discovered by ? in WordPress Npm liquidjs versions = 10.27.1...
MAL-2026-16047 Malicious code in @usemosaik/template-react-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3 This template package ships files/vite.config.js which, after a benign Vite header, appends 26KB of heavily obfuscated code obfuscator.io-style...
Malicious code in @usemosaik/template-react-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3 This template package ships files/vite.config.js which, after a benign Vite header, appends 26KB of heavily obfuscated code obfuscator.io-style...
ROOT-APP-NPM-CVE-2026-59875 CVE-2026-59875 in tar - Patched by Root
Root has patched CVE-2026-59875 in the tar package for Root:npm. Multiple fixed versions available...
NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replacetmpfilepath, filepath moves it to the final location line 799 3. Extraction begins vi...
GHSA-5WP5-5229-5G6Q NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replacetmpfilepath, filepath moves it to the final location line 799 3. Extraction begins vi...
EUVD-2026-52226
NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection...
CLSA-2026-1788878815 TuxCare security update for 90 packages (2 CVEs)
TuxCare rebuilt 90 packages to address 2 CVEs. Fixed in 9.4.50.v20221201-tuxcare.5...