Lucene search
+L

18507 matches found

OSV
OSV
added 2026/06/23 5:24 p.m.12 views

CVE-2026-44726 Deno: TLS retry copies stale upgrade hook, risking plaintext traffic

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When autoSelectFamily was enabled and the first address-family attempt...

7.4CVSS6AI score
SaveExploits0References3
AlpineLinux
AlpineLinux
added 2026/06/23 5:22 p.m.23 views

CVE-2026-49401

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done...

8.4CVSS5.9AI score0.00197EPSS
SaveExploits1References1
OSV
OSV
added 2026/06/23 5:20 p.m.15 views

CVE-2026-49402 Deno: Command Injection via spawnSync & spawn on Windows

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:childprocess implementation provided an escapeShellArg helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.e...

8.1CVSS6.1AI score
SaveExploits0References3
OSV
OSV
added 2026/06/23 5:16 p.m.11 views

CVE-2026-49983 Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny it with --deny-env, or restrict it to a specific allowlist with --allow-env=FOO,BAR. The expectation is that a program running without env permission cannot...

5.2CVSS6AI score
SaveExploits0References3
AlpineLinux
AlpineLinux
added 2026/06/23 5:16 p.m.27 views

CVE-2026-49983

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gated by the env permission. You can deny it with --deny-env, or restrict it to a specific allowlist with --allow-env=FOO,BAR. The expectation is that a program running without env permission cannot...

5.2CVSS5.8AI score0.0014EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/23 4:17 p.m.25 views

CVE-2026-56696

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

5.4CVSS0.0037EPSS
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/23 4:07 p.m.16 views

Malicious code in ts-biginteger-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8059a1d2db2edb7231b017023f82f6a651585c0ee7120aaebe882cb6407b9e3 Package is published as 'ts-biginteger-lib' but its metadata, README, and source are a wholesale copy of big.js by MikeMcl author set to 'Michael...

6.4AI score
SaveExploits0References2
OSV
OSV
added 2026/06/23 4:07 p.m.22 views

MAL-2026-6316 Malicious code in ts-biginteger-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8059a1d2db2edb7231b017023f82f6a651585c0ee7120aaebe882cb6407b9e3 Package is published as 'ts-biginteger-lib' but its metadata, README, and source are a wholesale copy of big.js by MikeMcl author set to 'Michael...

6.4AI score
SaveExploits0References2
OSV
OSV
added 2026/06/23 3:55 p.m.12 views

MAL-2026-6326 Malicious code in web3-eth-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a262e70316cd74a87b043cd1985e456639781763d4a3ef69aa09d99a2795154 Package name, README, repository URL, contributors, and module structure are copied from the legitimate '@ethereumjs/util' / 'ethereumjs-util' packag...

6.4AI score
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/06/23 3:36 p.m.10 views

CVE-2026-56696

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

5.4CVSS6AI score0.0037EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/23 3:36 p.m.14 views

EUVD-2026-38469

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

5.4CVSS6AI score0.0037EPSS
SaveExploits0References3
OSV
OSV
added 2026/06/23 3:36 p.m.11 views

CVE-2026-56696 OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands

OpenHarness /issue and /prcomments slash commands lack remoteinvocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/prcomments....

5.3CVSS6AI score
SaveExploits0References6
NVD
NVD
added 2026/06/23 1:16 p.m.25 views

CVE-2026-56762

Hono before 4.12.12 does not validate cookie names on the write path in the setCookie, serialize, and serializeSigned functions, allowing invalid characters such as control characters e.g. \r or \n when an application passes a user-controlled cookie name. This can produce malformed Set-Cookie...

6.9CVSS0.00418EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/23 12:13 p.m.35 views

CVE-2026-56762

Hono CVE-2026-56762 affects Hono before 4.12.12, where cookie-name validation is missing on the write path in setCookie(), serialize(), and serializeSigned(). This allows invalid characters (e.g., control chars like \r/\n) in user-controlled cookie names, producing malformed Set-Cookie header val...

6.9CVSS5.9AI score0.00418EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/06/23 12:13 p.m.48 views

CVE-2026-56762 Hono - Missing Cookie Name Validation in setCookie()

Hono before 4.12.12 does not validate cookie names on the write path in the setCookie, serialize, and serializeSigned functions, allowing invalid characters such as control characters e.g. \r or \n when an application passes a user-controlled cookie name. This can produce malformed Set-Cookie...

6.9CVSS0.00418EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/06/23 12:13 p.m.15 views

CVE-2026-56762 Hono - Missing Cookie Name Validation in setCookie()

Hono before 4.12.12 does not validate cookie names on the write path in the setCookie, serialize, and serializeSigned functions, allowing invalid characters such as control characters e.g. \r or \n when an application passes a user-controlled cookie name. This can produce malformed Set-Cookie...

6.9CVSS5.9AI score0.00418EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/06/23 12:13 p.m.15 views

CVE-2026-56762

Hono before 4.12.12 does not validate cookie names on the write path in the setCookie, serialize, and serializeSigned functions, allowing invalid characters such as control characters e.g. \r or \n when an application passes a user-controlled cookie name. This can produce malformed Set-Cookie...

6.9CVSS5.9AI score0.00418EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/06/23 12:13 p.m.23 views

EUVD-2026-38443

Hono before 4.12.12 does not validate cookie names on the write path in the setCookie, serialize, and serializeSigned functions, allowing invalid characters such as control characters e.g. \r or \n when an application passes a user-controlled cookie name. This can produce malformed Set-Cookie...

6.9CVSS5.9AI score0.00418EPSS
SaveExploits0References2
Fedora
Fedora
added 2026/06/23 1:09 a.m.14 views

[SECURITY] Fedora 44 Update: erlang-26.2.5.21-3.fc44

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson...

6.5CVSS5.8AI score0.00277EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/23 12:00 a.m.24 views

PT-2026-51516

Name of the Vulnerable Software and Affected Versions Hono versions prior to 4.12.12 Description The software fails to validate cookie names within the setCookie, serialize, and serializeSigned functions. When an application uses a user-controlled cookie name, invalid characters such as control...

6.9CVSS5.8AI score0.00418EPSS
SaveExploits0References7
Rows per page
Query Builder