48 matches found
Query-Hub
CQL-Hub | CrowdStrike SIEM & LogScale Queries Welcome to the CQL-Hub Backend Repository This repository powers cql-hub.com: A free, community-driven hub for CrowdStrike Falcon SIEM queries. All queries stored here are automatically published and made visible on the CQL-Hub website, making it easi...
advisory-database
Python Packaging Advisory Database ćććÆćhttps://pypi.org ć§å ¬éććć¦ććććć±ć¼ćøć®ć¢ććć¤ć¶ćŖćē®”ēććć³ćć„ććć£ęęć®ćŖććøććŖć§ćć ć¢ććć¤ć¶ćŖćÆ vulns ćć£ć¬ćÆććŖć«ę ¼ē“ćććć·ć³ćć«ćŖå½¢å¼ ć® YAML ćØć³ć³ć¼ćć£ć³ć°ćä½æēØćć¾ćć ć¢ććć¤ć¶ćŖćøć®č²¢ē® ćć«ćŖćÆćØć¹ćć®ä½ę ę¢åć®ćØć³ććŖćÆććć«ćŖćÆćØć¹ććä½ęććć ćć§ē·Øéć§ćć¾ćć ę°ćććØć³ććŖćčæ½å ććć«ćÆćPYSEC-0000-.yaml ćØććååć®ę°ćććć”ć¤ć«ćå«ććć«ćŖćÆćØć¹ććä½ęćć¦ćć ććććććÆććć¼ćøå¾ć«é©åćŖ ID...
SUSE SLES15 Security Update : yq (SUSE-SU-2026:3327-1)
The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3327-1 advisory. Update to v4.53.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass a...
CVE-2026-57076
YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syckhdlraddanchor. In the bundled libsyck an anchor name allocated by syckstrndup is stored both as node-anchor, freed when the node is freed, and as the key in the parser's...
CVE-2026-45304 Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structur...
js-yaml: js-yaml: Denial of Service via crafted YAML documents
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...
CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...
PYSEC-2026-1344 Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload
Impact The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal system...
js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys
A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU ti...
PYSEC-2026-430 OpenStack Murano Code Execution
OpenStack Murano before 1.0.3 liberty and 2.x before 2.0.1 mitaka, Murano-dashboard before 1.0.3 liberty and 2.x before 2.0.1 mitaka, and python-muranoclient before 0.7.3 liberty and 0.8.x before 0.8.5 mitaka improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files,...
Off-by-one Error
Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...
CVE-2026-40169
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, a crafted image could result in an out of bounds heap write when writing a yaml or json output, resulting in a crash. This issue has been fixed in version 7.1.2-19...
CVE-2026-34730
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's externaldata feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local fil...
CVE-2021-33493
The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format...
EUVD-2025-178902
Malicious code in final-scale-static-yaml-debug npm...
Malicious code in yaml-gatsby-yildun-less (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9176cc856a7e1b77aae4968733ab2bea8d8ddf71d2233a9e6f1ef1c0f9e0646f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-116520
Malicious code in ariel-cluster-yaml-vega npm...
EUVD-2025-123639
Malicious code in playwright-library-build-yaml npm...
