112177 matches found
CVE-2026-12425
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting XSS. This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it...
CVE-2026-48294
Adobe Acrobat PDF Extension Chrome versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in tha...
CVE-2026-48776
CVE-2026-48776 affects LangGraph Python SDK (versions up to 0.3.14) and describes unsafe URL path construction from unsanitized caller-supplied identifiers in HTTP request paths. This can cause requests to target a different resource or resource type, enabling unintended access, modification, or ...
CVE-2026-12425
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting XSS. This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it...
GHSA-G75F-G53V-794X
creationtimestamp| type| source ---|---|--- 2026-06-16 16:41:37+00:00| seen| https://gist.github.com/alon710/5922ad26f6aa39fcda791f945c3402e2...
Malicious code in chain-chai-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4287ff6637bb0d3109dcdc3082aece79d69deca2a3580ebf850ec1c13e8a3e00 [email protected] advertises itself as a pino-style logger keywords fast/logger/stream/json, exported alias module.exports.pino = middleware,...
MAL-2026-5908 Malicious code in chain-chai-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4287ff6637bb0d3109dcdc3082aece79d69deca2a3580ebf850ec1c13e8a3e00 [email protected] advertises itself as a pino-style logger keywords fast/logger/stream/json, exported alias module.exports.pino = middleware,...
Malicious code in uidai_reusable_components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5875a720dc1cfc6e30a67b003fc43975fbef2e11352e715e19e55e54dd84ae67 On npm install, the preinstall lifecycle script in package.json executes an inline Node one-liner that collects the installer's hostname, OS username...
CVE-2026-48780
creationtimestamp| type| source ---|---|--- 2026-06-16 16:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mog67gafbm25 2026-06-16 18:03:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogf2rqlzg2c...
MAL-2026-5889 Malicious code in @dsft/ft-element (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...
CVE-2026-12328
creationtimestamp| type| source ---|---|--- 2026-06-16 14:58:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mog2qgnwtj2x 2026-06-16 17:00:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogbl2aocw2f 2026-06-17 20:00:00+00:00| seen|...
CVE-2026-9507
creationtimestamp| type| source ---|---|--- 2026-06-16 14:53:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mog2hi73xp2v...
Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
Summary nltk.data.load in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname decodes the %xx sequences a classic decode-after-check / TOCTOU-style flaw, allowing ...
GHSA-P4GQ-832X-FM9V Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read
Summary nltk.data.load in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname decodes the %xx sequences a classic decode-after-check / TOCTOU-style flaw, allowing ...
CVE-2026-12324
creationtimestamp| type| source ---|---|--- 2026-06-16 14:33:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofzdog3of2b 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...
CVE-2026-12330
creationtimestamp| type| source ---|---|--- 2026-06-16 14:25:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofyvbjse52g 2026-06-16 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1924 2026-06-17 20:00:00+00:00| seen|...
CVE-2026-12325
creationtimestamp| type| source ---|---|--- 2026-06-16 14:13:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofyakf6b62i 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...
CVE-2026-53900
creationtimestamp| type| source ---|---|--- 2026-06-16 14:05:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofxrmn5go2g 2026-06-17 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260618...
MAL-2026-5885 Malicious code in wordpad-text-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d4d50aa948a360a788613f1fee19f4d1853c93d8792a5899c620e56d40c53ad On npm install, the declared postinstall hook runs node main.js, which decodes an obfuscated URL stored as...
Malicious code in wordpad-text-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d4d50aa948a360a788613f1fee19f4d1853c93d8792a5899c620e56d40c53ad On npm install, the declared postinstall hook runs node main.js, which decodes an obfuscated URL stored as...