Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
125 results · page 1 of 3
Oct 8, 2026Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrdCVE-2026-44037 · Other software · OFFIS · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cMedium 6.8
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.
- Product
- DCMTK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.dcmtk.org
Sep 15, 2026Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability.CVE-2026-19504 · Other software · Fabric.js · reported by zdi-disclosures@trendmicro.comMedium 4
Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of the loadFromJSON method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker may be able to leverage this vulnerability to gain improper access to network resources. Was ZDI-CAN-29318.
- Product
- Fabric.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026A vulnerability was determined in Cesanta mJS up to 1.26.CVE-2026-86716 · Other software · Cesanta · reported by VulDBMedium 5.5
A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- mJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntaxCVE-2026-18482 · Other software · Klarso GmbH · reported by cret@cert.orgCritical 9.8
Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools. Commit 88c77fc fixes these vulnerabilities.
- Product
- neo-mjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation.CVE-2026-12473 · Other software · Open Health Imaging Foundation (OHIF) · reported by ics-cert@hq.dhs.govHigh 8.3
Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.
- Product
- DICOM Web Viewer Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026A security flaw has been discovered in CesiumGS CesiumJS up to 1.137.0.CVE-2026-3990 · Other software · CesiumGS · reported by VulDBLow 2.1
A security flaw has been discovered in CesiumGS CesiumJS up to 1.137.0. Affected by this issue is some unknown functionality of the file Apps/Sandcastle/standalone.html. The manipulation of the argument c results in cross site scripting. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The presence of this vulnerability remains uncertain at this time. The vendor was contacted early about this disclosure but did not respond in any way. According to CVE-2023-48094, "the vendor's position is that Apps/Sandcastle/standalone.html is part of the CesiumGS/cesium GitHub repository, but is demo code that is not part of the CesiumJS JavaScript library product."
- Product
- CesiumJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.CVE-2025-11230 · Other software · HAProxy Technologies · reported by security@ubuntu.comHigh 7.5
Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
- Product
- HAProxy Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025spmrc is a package that provides the rc manager for spm.CVE-2025-57327 · Other software · Spmjs · reported by MITREHigh 7.5
spmrc is a package that provides the rc manager for spm. A Prototype Pollution vulnerability in the set and config function of spmrc version 1.2.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service (DoS) as the minimum consequence.
- Product
- Spmrc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the nCVE-2025-43989 · Other software · reported by MITREMedium 6.5
The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the ntpserver0 parameter, which is used in a system command. By setting a username=admin cookie (bypassing normal session checks), an unauthenticated attacker can use that parameter to execute arbitrary OS commands.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.medrive.proton.me
Apr 19, 2025mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as 8891110122900e913013935755114.CVE-2023-30421 · Other software · mjson project · reported by MITRELow 2.9
mystrtod in mjson 1.2.7 requires more than a billion iterations during processing of certain digit strings such as 8891110122900e913013935755114.
- Product
- mjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), bCVE-2024-53382 · Other software · PrismJS · reported by MITREMedium 4.9
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
- Product
- Prism
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 10, 2024All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different functions.CVE-2024-21523 · Other software · npmjs · reported by report@snyk.ioHigh 7.5
All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different functions. This makes it possible to reach an assert macro, leading to a process crash. **Note:** By providing some specific integer values (like 0) to the size function, it is possible to obtain a Segmentation fault error, leading to the process crash.
- Product
- images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 21, 2024An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file.CVE-2024-35386 · Other software · cesanta · reported by MITREHigh 7.5
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file.
- Product
- mjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2024An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_mk_ffi_sig function in the mjs.c file.CVE-2024-35385 · Other software · cesanta · reported by MITREMedium 4.3
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_mk_ffi_sig function in the mjs.c file.
- Product
- mjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2024An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file.CVE-2024-35384 · Other software · cesanta · reported by MITREMedium 5.5
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file.
- Product
- mjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2024RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function.CVE-2024-25354 · Other software · npmjs · reported by MITREHigh 7.5
RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function.
- Product
- domain-suffix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jan 2, 2024An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file.CVE-2023-49553 · Other software · Cesanta · reported by MITREHigh 7.5
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file.CVE-2023-49552 · Other software · Cesanta · reported by MITREHigh 7.5
An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.CVE-2023-49551 · Other software · Cesanta · reported by MITREHigh 7.5
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component.CVE-2023-49550 · Other software · Cesanta · reported by MITREHigh 7.5
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file.CVE-2023-49549 · Other software · Cesanta · reported by MITREHigh 7.5
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2023Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.CVE-2023-50044 · Other software · Cesanta · reported by MITRECritical 9.8
Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-baseCVE-2023-49145 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.9
Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation.
- Product
- Apache NiFi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Nov 14, 2023A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crCVE-2023-48094 · Other software · Cesium · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a crafted payload to /container_files/public_html/doc/index.html. NOTE: the vendor’s position is that Apps/Sandcastle/standalone.html is part of the CesiumGS/cesium GitHub repository, but is demo code that is not part of the CesiumJS JavaScript library product.
- Product
- Cesiumjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 25, 2023ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component.CVE-2023-39619 · Other software · Teomantuncer · reported by MITREHigh 7.5
ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component.
- Product
- Node Email Check
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 22, 2023Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr().CVE-2023-43338 · Other software · Cesanta · reported by MITRECritical 9.8
Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr(). This vulnerability allows attackers to execute arbitrary code via a crafted input.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2023webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloader.PhantomJSDownloaCVE-2023-39015 · Other software · Code4craft · reported by MITRECritical 9.8
webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloader.PhantomJSDownloader.
- Product
- Webmagic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2023Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data CVE-2022-25883 · Other software · Npmjs · reported by report@snyk.ioMedium 5.3
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
- Product
- Semver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023An issue was discovered mjson thru 1.4.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependenCVE-2023-34611 · Other software · Mjson Project · reported by MITREHigh 7.5
An issue was discovered mjson thru 1.4.1 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies.
- Product
- Mjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c.CVE-2023-30088 · Other software · Cesanta · reported by MITREMedium 5.5
An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c.CVE-2023-30087 · Other software · Cesanta · reported by MITREMedium 5.5
Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c.CVE-2023-29570 · Other software · Cesanta · reported by MITREMedium 5.5
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c.CVE-2023-29569 · Other software · Cesanta · reported by MITREMedium 5.5
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c.CVE-2023-29571 · Other software · Cesanta · reported by MITREMedium 5.5
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf.CVE-2021-36535 · Other software · Cesanta · reported by MITREMedium 5.5
Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33449 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_part_get_by_offset() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33448 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow at 0x7fffe9049390.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33447 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_print() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33446 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_next() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33445 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_string_char_code_at() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33444 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in getprop_builtin_foreign() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33443 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in mjs_execute() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33442 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in json_printf() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33441 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in exec_expr() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33440 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_commit() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33439 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is Integer overflow in gc_compact_strings() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33438 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in json_parse_array() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jul 26, 2022An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6).CVE-2021-33437 · Other software · Cesanta · reported by MITREMedium 5.5
An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There are memory leaks in frozen_cb() in mjs.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 18, 2022Prism is a syntax highlighting library.CVE-2022-23647 · Other software · PrismJS · reported by GitHubHigh 7.5
Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.
- Product
- prism
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_bcode_insert_offset at src/mjs_bcode.c.CVE-2021-46556 · Other software · Cesanta · reported by MITREMedium 5.5
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_bcode_insert_offset at src/mjs_bcode.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.