2877 matches found
Cross-site Scripting (XSS)
Overview org.webjars.npm:svelte is a package for building web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the spread syntax when rendering attributes from untrusted data during server-side rendering. An attacker can execute arbitrary JavaScript i...
CVE-2026-25903
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to...
GHSA-C5W7-M8WF-XC77 Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to...
Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to...
CVE-2026-25903
Summary: CVE-2026-25903 affects Apache NiFi 1.1.0–2.7.2, where updating configuration properties on extension components with Restricted annotation permissions bypasses some authorization checks. This can allow a user with lower privileges to modify properties for components that require higher p...
Realmo Launches Location Intelligence Engine to Match Vacant Properties with Their Best Use
Boston, Massachusetts, 17th February 2026, CyberNewswire...
nodejs-underscore: Arbitrary code execution via the template function
A flaw was found in nodejs-underscore. Arbitrary code execution via the template function is possible, particularly when a variable property is passed as an argument as it is not sanitized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
taffy: taffydb: Internal Property Tampering
taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found...
Arbitrary PDF Object Injection
jsPDF is vulnerable to arbitrary PDF object injection. The vulnerability is due to insufficient sanitization of user-controlled Acroform properties and methods, which allows an attacker to inject malicious PDF objects such as JavaScript actions that execute when the document is opened...
PT-2026-7150
Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.30.3 Axios versions prior to 1.13.5 Description The mergeConfig function in Axios crashes with a TypeError when processing configuration objects that contain proto as an own property. This occurs because when proto is...
RLSA-2025:18285 Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: thunderbird: firefox: Memory safety bugs CVE-2025-11714 thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures CVE-2025-11709...
CVE-2026-25586 SandboxJS has a Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty on a sandbox object, which disables prototype whitelist enforcement in the property-access path. This permits direct access to proto and other blocked prototype properties,...
PT-2026-6275
Name of the Vulnerable Software and Affected Versions Qwik versions prior to 1.19.0 Description Qwik is a performance focused javascript framework. A prototype pollution issue exists in the formToObj function within the @builder.io/qwik-city middleware. The function processes form field names usi...
CVE-2025-47399
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters...
EUVD-2025-206611
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters...
CVE-2025-47399 Buffer Copy Without Checking Size of Input in Camera
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters...
CVE-2025-47399 Buffer Copy Without Checking Size of Input in Camera
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters...
Qualcomm Chipsets 安全漏洞
Qualcomm Chipsets are a series of chipset developed by Qualcomm Incorporated in the United States. There are security vulnerabilities in Qualcomm Chipsets. These vulnerabilities arise when processing IOCTL calls with invalid input parameters to update sensor property settings, which may lead to...
GHSA-2CP6-34R9-54XX Maker.js has Unsafe Property Copying in makerjs.extendObject
Summary The makerjs.extendObject function copies properties from source objects without proper validation, potentially exposing applications to security risks. The function lacks hasOwnProperty checks and does not filter dangerous keys, allowing inherited properties and potentially malicious...