116604 matches found
CVE-2025-69948
creationtimestamp| type| source ---|---|--- 2026-08-03 17:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms72plzxnp2a...
CVE-2025-69946
creationtimestamp| type| source ---|---|--- 2026-08-03 17:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms72pkjtn22z...
CVE-2026-69152
creationtimestamp| type| source ---|---|--- 2026-08-03 17:31:36+00:00| seen| https://gist.github.com/alon710/d80e5d80b7549449b84a63552411d4ec 2026-08-03 18:26:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hlxnpa6jl7kfg 2026-08-04 12:00:52+00:00| seen|...
CVE-2026-69153
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...
UBUNTU-CVE-2026-69153
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...
Directory Traversal
Overview postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal in the PreviousMap.loadFile method of lib/previous-map.js, which nests its traversal guard inside an if cssFile branch that is skipped when the...
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
Summary The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile that restricts an attacker-controlled sourceMappingURL from a CSS comment to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is...
GHSA-FXQJ-RQCC-2CMP PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
Summary The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile that restricts an attacker-controlled sourceMappingURL from a CSS comment to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is...
Directory Traversal
Overview org.webjars.npm:postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal in the PreviousMap.loadFile method of lib/previous-map.js, which nests its traversal guard inside an if cssFile branch that is...
NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
NPM: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.22...
CVE-2019-1749
creationtimestamp| type| source ---|---|--- 2026-08-03 17:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96464 2026-08-04 00:00:32+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96464...
EUVD-2026-52373
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...
CVE-2026-69153
CVE-2026-69153 (PostCSS) affects PostCSS prior to 8.5.19. If the option from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL, exposing the map’s sources and sourcesContent. The issue is f...
CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...
CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...
CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...
CVE-2026-69153
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...
CVE-2026-69149
creationtimestamp| type| source ---|---|--- 2026-08-03 16:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms6xhtypny2p 2026-08-03 18:14:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5nwaq22vg5q3w 2026-08-05 02:26:04+00:00| seen|...
CVE-2026-68945
creationtimestamp| type| source ---|---|--- 2026-08-03 16:32:48+00:00| seen| https://gist.github.com/alon710/73fc02db3c552514344a681ca47f8151 2026-08-03 18:08:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/76ddsj6kowu3a...