9909 matches found
Malicious code in noderzero (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fa08be36ae12861809af052871d79536e7ed601c90bb2cff80fa0371e2c4ce noderzero is a self-described 'stealth assistant' that exfiltrates clipboard contents and full-screen screenshots to a hardcoded author-controlled...
MAL-2026-5897 Malicious code in noderzero (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fa08be36ae12861809af052871d79536e7ed601c90bb2cff80fa0371e2c4ce noderzero is a self-described 'stealth assistant' that exfiltrates clipboard contents and full-screen screenshots to a hardcoded author-controlled...
Chromium: CVE-2026-11698 Use after free in Bluetooth
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-11660 Insufficient validation of untrusted input in New Tab Page
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
PT-2026-54132
Name of the Vulnerable Software and Affected Versions Google Chrome on Linux versions prior to 150.0.7871.47 Description A use after free issue exists in Ozone, which is a platform-agnostic abstraction layer for windowing and input. This flaw allows a remote attacker to execute arbitrary code via...
CVE-2026-20262 Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate...
Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate...
VulnCheck KEV: CVE-2026-20262
Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system...
PT-2026-49259
Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager affected versions not specified Description A directory or path traversal issue exists in the web UI of Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage. The flaw occurs because the software does not properly...
The vulnerability of the Media components in Google Chrome and Microsoft Edge allows a hacker to replace the user interface.
The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to replace the user interface through a created HTML page...
The vulnerability of the Tab Strip control element in Google Chrome and Microsoft Edge browsers allows a hacker to perform domain substitution attacks.
The vulnerability of the Tab Strip control element in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow an attacker to perform domain substitution through a created HTML page...
The vulnerability of the File Input service in Google Chrome and Microsoft Edge browsers allows a hacker to replace the user interface.
The vulnerability of the File Input service in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow an attacker to replace the user interface through a created HTML page...
The vulnerability of the Tab Hover Cards component in Google Chrome and Microsoft Edge browsers allows a hacker to perform domain substitution attacks.
The vulnerability of the Tab Hover Cards component in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow an attacker to replace a domain name using a created domain name...
The vulnerability of the user interface of the WebUI on Google Chrome and Microsoft Edge browsers allows a hacker to perform domain substitution.
The vulnerability of the WebUI user interface of Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow a malicious actor to perform domain substitution using a created domain name...
Cross-site Request Forgery (CSRF)
github.com/juev/nebula-mesh is vulnerable to Cross-site Request Forgery CSRF. The vulnerability is due to missing CSRF protection on /ui/ state-changing endpoints, where requests are processed based solely on a valid session cookie, allowing attackers to perform unauthorized administrative action...
User Interface (UI) Misrepresentation of Critical Information
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information via the approval display truncation. An attacker can execute unauthorized operations by submitting oversized exec commands with...
CVE-2026-54395
CVE-2026-54395 affects MISP (UiBeta event index view) with a reflected XSS in the advanced filter popup. The urlparams value is inserted into an inline JavaScript handler inside a single-quoted string; browsers HTML-decode attribute values before JS parsing, enabling an attacker to craft a URL th...
EUVD-2026-36530
Solidtime is an open-source time-tracking app. Prior to version 0.12.2, Solidtime defines an explicit invitations:view and members:view permissions that gates the official invitations and members API. The Jetstream web team page authorizes access with only belongsToTeam and then loads and...
Fedora 43 : chromium (2026-c5c0986fb6)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c5c0986fb6 advisory. Update to 149.0.7827.102 CVE-2026-11628: Use after free in Ozone CVE-2026-11629: Use after free in Ozone CVE-2026-11630: Use after free in File Inpu...
CVE-2026-53817
OpenClaw before 2026.5.22 contains a locality validation vulnerability in Control UI pairing that allows attackers with network access to spoof locality information and obtain durable admin-capable device tokens. Attackers can exploit insufficient locality-derived trust validation to convert...