Search
730 results- CRITICAL9.6CVE-2026-47428Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
- CRITICAL9.8CVE-2026-47429When Vitest UI server is listening, arbitrary file can be read and executed
- CRITICAL10.0CVE-2026-47140NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
- CRITICAL9.8CVE-2026-47210vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
- CRITICAL10.0CVE-2026-47137vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
- CRITICAL10.0CVE-2026-47208vm2 is Vulnerable to Sandbox Breakout Through Promise Species
- CRITICAL10.0CVE-2026-47131vm2 has a Sandbox Escape issue
- CRITICAL10.0CVE-2026-45618LiquidJS is Vulnerable to Remote Code Execution
- CRITICAL9.6CVE-2026-46703Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
- CRITICAL10.0CVE-2026-46695BoxLite: Permission Bypass Allows Modification of Read-Only Files
- CRITICAL10.0CVE-2026-46412Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
- CRITICAL9.8CVE-2026-45772EPSS 0.10%Turbo: Unexpected local code execution during Yarn Berry detection
- CRITICAL10.0CVE-2026-463399router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
- CRITICAL9.8CVE-2026-45411EPSS 0.08%vm2 Has a Sandbox Breakout Using Async Generator
- CRITICAL9.6CVE-2026-45311EPSS 0.04%DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval
- CRITICAL9.3CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
- CRITICAL9.1CVE-2026-44650EPSS 0.08%SillyTavern has a Path Traversal issue
- CRITICAL9.8CVE-2026-44649EPSS 0.07%SillyTavern has Authentication Bypass via SSO Header Injection
- CRITICAL9.1CVE-2026-45091EPSS 0.01%sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
- CRITICAL9.6CVE-2026-45321⚠ KEVEPSS 17.1%Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
- CRITICAL10.0CVE-2026-43898EPSS 0.05%SandboxJS has a sandbox escape via Function.caller leakage of internal call op
- CRITICAL9.8CVE-2026-25244EPSS 0.15%WebdriverIO BrowserStack Service has a Command Injection issue
- CRITICAL9.6CVE-2026-44211EPSS 0.02%Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
- CRITICAL9.6CVE-2026-43944EPSS 0.15%Electerm users can run dangrous code through link or command line
- CRITICAL9.8CVE-2026-43940EPSS 0.04%Electerm runWidget has a path traversal that leads to arbitrary code execution
Page 1 of 30Next →