Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-5892

chromium-browser: Insufficient policy enforcement in PWAs

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google Linux and 1 more
Products
Macos Chrome Linux Kernel and 1 more
CVE-2023-32002

nodejs: Permissions policies can be bypassed via Module._load

The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Nodejs Redhat
Products
Node.js Nodejs Enterprise Linux and 1 more
CVE-2023-32004

nodejs: Permission model bypass by specifying a path traversal sequence in a Buffer

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVSS 3.1 · 8.8 High EPSS 2.1% KEV · Not listed
Vendors
Fedoraproject Nodejs
Products
Fedora Node.js
CVE-2023-32005

nodejs: fs.statfs can retrive stats from files restricted by the Permission Model

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.statfs` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Nodejs
Products
Node.js