Incomplete List of Disallowed Inputs

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the lookupProperty function in lib/handlebars/runtime.js, which returns the resolved value as soon as...

Incomplete List of Disallowed Inputs

Overview org.webjars.npm:handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the lookupProperty function in lib/handlebars/runtime.js, which returns the resolved value as soon as...

Malicious code in npm-hex-utils (npm)

Source: amazon-inspector 6a0f1f9004b6a502c144d4d475e89a3956905aebf51fb2696d4ba05c21613727 The package's postinstall runs runtime.js, which POSTs os.hostname, os.userInfo.username, os.platform+os.arch, Node version, and OS release to https://steel-mere-4155.ricardorichp.workers.dev/report, then...

CVE-2026-53977

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler...

CVE-2026-53977: Missing Authentication for Critical Function

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler...

PT-2026-68619

Name of the Vulnerable Software and Affected Versions OpenChamber version 1.11.7 Description An authentication bypass allows unauthenticated remote attackers to terminate the server process, resulting in a denial of service for all active AI coding sessions and locking out legitimate users. This...

Malicious code in bigops-products-bnpl (npm)

Source: amazon-inspector 79495f4d434b2f860f25315bc4c035d0db6956c8184ccb9a8068d1f6a4a15673 On require'bigops-products-bnpl', index.js loads runtime.js, which selects a platform-specific endpoint and downloads an opaque binary from one of four hardcoded Cloudflare Workers hosts...

CVE-2016-1627

The Developer Tools aka DevTools subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted...

CVE-2016-1627: Undefined Security Weakness

The Developer Tools aka DevTools subsystem in Google Chrome before 48.0.2564.109 does not validate URL schemes and ensure that the remoteBase parameter is associated with a chrome-devtools-frontend.appspot.com URL, which allows remote attackers to bypass intended access restrictions via a crafted...

PT-2016-1258

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 48.0.2564.109 Description The issue is related to the Developer Tools aka DevTools subsystem, which does not properly validate URL schemes and ensure that the remoteBase parameter is associated with a...