20789 matches found
@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-59195 via pnpm (>=10.0.0, <=10.33.2)
pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-59195 Source advisory: SNYK:JS-PNPM-17660535...
@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-59195 via pnpm (>=10.0.0, <=10.33.2)
pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-59195 Source advisory: OSV:GHSA-QRV3-253H-G69C...
EUVD-2026-36598
Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwtsecretkey...
EUVD-2026-36600
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context...
EUVD-2026-38069
YARD static cache reads raw traversal paths before router sanitization...
JLSEC-2026-636
Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/afstereowiden.c:120:69...
@10xsai/cloudflare-router-nx-plugin (1.0.0), @abelfubu/schematics (0.1.1) +688 more potentially affected by CVE-2026-54753 via nx (>=17.0.4, <=22.7.1)
nx NPM version =17.0.4, =2.2.1, =0.0.1, =0.1.5, =0.0.3, =0.0.4, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =1.0.1 - @aloes/nx-heroku 0.4.1 - @altariotechnologieslisbon/query-resolver 0.14.2 and more Source cves: CVE-2026-54753 Source advisory: SNYK:JS-NX-17660796...
CVE-2026-55448
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credentialcommand from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a...
CVE-2026-55441
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files mise.toml, .tool-versions through trustcheck, but task-include files are loaded on a path that never reaches it. When a directory has a task-include dir mise-tasks/,...
CVE-2026-54557
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend's symlin...
CVE-2026-33646
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the exec function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not...
CVE-2026-33646
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the exec function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not...
CVE-2026-33646
CVE-2026-33646 affects Mise: prior to 2026.3.10, Processed .tool-versions with Tera where exec() is registered, allowing arbitrary code execution when a malicious .tool-versions file is parsed during shell CD hooks. Unlike .mise.toml, .tool-versions is not trusted in non-paranoid mode, so an atta...
CVE-2026-33646 mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the exec function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not...
CVE-2026-33646 mise: Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the exec function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not...
CVE-2026-55441
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files mise.toml, .tool-versions through trustcheck, but task-include files are loaded on a path that never reaches it. When a directory has a task-include dir mise-tasks/,...
CVE-2026-55441 mise: Arbitrary command execution via task-include files in an untrusted, config-less repository
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files mise.toml, .tool-versions through trustcheck, but task-include files are loaded on a path that never reaches it. When a directory has a task-include dir mise-tasks/,...
CVE-2026-54557
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend's symlin...
EUVD-2026-39813
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credentialcommand from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a...
CVE-2026-55448 mise: Local credential_command executes untrusted config
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credentialcommand from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a...