Lucene search
+L

27799 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/24 4:44 p.m.19 views

Malicious code in auth-otp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72292101c6b448dbaea5dc1e2af91cc55b35b32ee1e722c4f5b21dfb91e032d Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs node lib/core.js --setup as a postinstall lifecycle script...

5.5AI score
SaveExploits0References6
CVE
CVE
added 2026/08/24 4:12 p.m.72 views

CVE-2026-19685

NetworkManager failed to enforce the private_user restriction on the 802-1x.ca-path and phase2-ca-path directory-valued connection properties—an incomplete fix for CVE-2025-9615. An unprivileged local user can point a private WPA-Enterprise (802.1X) profile's CA path at an attacker-controlled dir...

9.8CVSS5.2AI score0.00158EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/24 4:12 p.m.12 views

EUVD-2026-64957

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

7.1CVSS5.4AI score0.00136EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/24 4:12 p.m.27 views

CVE-2026-19685 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

7.1CVSS5.5AI score
SaveExploits0References8
Vulnrichment
Vulnrichment
added 2026/08/24 4:12 p.m.10 views

CVE-2026-19685 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

7.1CVSS5.3AI score0.00158EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2026/08/24 3:59 p.m.10 views

CVE-2026-19685

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

9.8CVSS5.3AI score0.00136EPSS
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/24 3:53 p.m.19 views

Malicious code in dims-hydration-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a85d660f6cc363a81624c7383318958bb46f2d6958fdad71e595692420d805d On any import 'dims-hydration-ui', index.mjs chmods 0755 and spawns a bundled Linux x8664 ELF at dist/internal/calc.dat as a detached child, describe...

6AI score
SaveExploits0References2
CVE
CVE
added 2026/08/24 2:51 p.m.34 views

CVE-2026-78414

A cross-site scripting (XSS) vulnerability exists in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 (Linux, Windows, macOS). An adjacent-network attacker who controls a rogue Nx server on the same network segment can set that server's site name to a script p...

8CVSS5.7AI score0.00216EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/24 2:51 p.m.10 views

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

8CVSS5.9AI score0.00216EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/24 2:14 p.m.28 views

CVE-2026-39915 TIM Flow < 26.0.6 CRLF Injection via rt Parameter

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers...

8.5CVSS0.00269EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/24 2:14 p.m.10 views

EUVD-2026-64892

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers...

8.5CVSS5.8AI score0.00269EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/24 2:14 p.m.29 views

CVE-2026-39915

TIM Flow before 26.0.6 is affected by a CRLF injection vulnerability in the rt URL parameter (and access token cookie), where unsanitized carriage return and line feed sequences are reflected into Set-Cookie response headers. Remote attackers can inject arbitrary HTTP headers and response body co...

8.5CVSS5.8AI score0.00269EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.7 views

Astra Linux – Vulnerability in git-lfs

Git LFS is an extension of Git for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host’s URL to the git-credential1 command without checking for embedded line-ending control characters. It then sends any credentials it receives back...

8.5CVSS7.2AI score0.01079EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.7 views

Astra Linux – Vulnerability in Firefox, Thunderbird

Using markup injection, an attacker could steal nonce values. This could be used to bypass strict content security policies. This vulnerability affects Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9...

6.1CVSS6.8AI score0.00704EPSS
SaveExploits1References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.5 views

Astra Linux – Vulnerability in Firefox and Thunderbird

A malicious extension could have opened a popup window without an address bar. The title of the popup without an address bar should not be fully controllable, but in this case it was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This...

6.5CVSS6.7AI score0.01113EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/24 8:08 a.m.10 views

MAL-2026-14403 Malicious code in react-emits (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91c19bc51fdcc52d657031b8a30c2fff700771d0948672a47033628784ec8acc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.7AI score
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2026/08/24 2:58 a.m.15 views

webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data

A flaw was found in WebKitGTK. A malicious website can silently hijack clipboard data due to improper state management...

6.5CVSS5.3AI score0.00437EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/08/24 2:10 a.m.16 views

webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data

A flaw was found in WebKitGTK. A malicious website can silently hijack clipboard data due to improper state management...

6.5CVSS5.3AI score0.00437EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/24 12:00 a.m.18 views

PT-2026-80914

Name of the Vulnerable Software and Affected Versions NetworkManager affected versions not specified Description NetworkManager failed to apply the private user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This allows an unprivileged local user to...

9.8CVSS5.3AI score0.00136EPSS
SaveExploits0References19
Positive Technologies
Positive Technologies
added 2026/08/24 12:00 a.m.18 views

PT-2026-80899

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

8CVSS5.8AI score0.00216EPSS
SaveExploits0References2
Rows per page
Query Builder