295446 matches found
CVE-2026-113613 FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python...
CLSA-2026-1792510080 TuxCare security update for @babel/plugin-proposal-optional-catch-binding (2 CVEs)
TuxCare rebuilt @babel/plugin-proposal-optional-catch-binding to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...
CLSA-2026-1792510079 TuxCare security update for @babel/plugin-proposal-optional-catch-binding (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-optional-catch-binding to address 1 CVE. Fixed in 7.18.9-tuxcare.3...
CLSA-2026-1792510077 TuxCare security update for @babel/plugin-proposal-optional-catch-binding (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-optional-catch-binding to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
CLSA-2026-1792510072 TuxCare security update for @babel/plugin-proposal-optional-catch-binding (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-optional-catch-binding to address 1 CVE. Fixed in 7.18.9-tuxcare.2...
CLSA-2026-1792510073 TuxCare security update for @babel/plugin-proposal-optional-catch-binding (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-optional-catch-binding to address 1 CVE. Fixed in 7.21.5-tuxcare.1...
CLSA-2026-1792510075 TuxCare security update for @babel/plugin-proposal-optional-catch-binding (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-optional-catch-binding to address 1 CVE. Fixed in 7.21.0-tuxcare.4...
CLSA-2026-1792510074 TuxCare security update for @babel/plugin-proposal-optional-catch-binding (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-optional-catch-binding to address 1 CVE. Fixed in 7.12.18-tuxcare.2...
CLSA-2026-1792510076 TuxCare security update for @babel/plugin-proposal-optional-catch-binding (2 CVEs)
TuxCare rebuilt @babel/plugin-proposal-optional-catch-binding to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...
CVE-2026-112947
The Vite frontend tooling framework (versions 8.2.0 through 8.2.4 and 8.3.3 ) is vulnerable to a path traversal and information exposure flaw. An attacker can request files outside the server.fs setting by using the ?vite-wasm-instance query parameter. The internal Wasm plugin's load hook handles...
CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-112947
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin SureCart versions = 4.9.5...
CLSA-2026-1792508343 TuxCare security update for @babel/plugin-transform-async-to-generator (2 CVEs)
TuxCare rebuilt @babel/plugin-transform-async-to-generator to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...
CLSA-2026-1792508341 TuxCare security update for @babel/plugin-transform-async-to-generator (1 CVE)
TuxCare rebuilt @babel/plugin-transform-async-to-generator to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
CLSA-2026-1792508339 TuxCare security update for @babel/plugin-transform-async-to-generator (2 CVEs)
TuxCare rebuilt @babel/plugin-transform-async-to-generator to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...
CLSA-2026-1792508340 TuxCare security update for @babel/plugin-transform-async-to-generator (1 CVE)
TuxCare rebuilt @babel/plugin-transform-async-to-generator to address 1 CVE. Fixed in 7.18.9-tuxcare.3...