jitsucom-jitsu-console

6 results · Clear filters · Feed

• High 8.2
  CVE-2026-40345 Public exploit

  deepmerge-ts: Stack exhaustion when merging recursive object graphs

  deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively mergi…

  RebeccaStevens deepmerge-ts langfuse-3-worker langfuse-3 Wolfi npm
  Aug 20, 2026
• High 8.1
  CVE-2026-4800 Public exploit

  lodash vulnerable to Code Injection via `_.template` imports key names

  The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

  lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm
  Mar 31, 2026
• High 7.5
  CVE-2025-65945 Public exploit

  auth0/node-jws improper HMAC signature verification vulnerability

  auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are …

  auth0 node-jws langfuse-3-worker renovate Wolfi npm
  Dec 4, 2025
• High 7.7
  CVE-2025-27152 Public exploit

  Possible SSRF and Credential Leakage via Absolute URL in axios Requests

  axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF…

  axios axios prism kubeflow-pipelines-apiserver Debian Ubuntu Wolfi npm
  Mar 7, 2025
• High 7.5
  CVE-2024-46982 Public exploit EPSS 59%

  Cache Poisoning in next.js

  Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this craft…

  vercel next.js jitsucom-jitsu-console next Wolfi npm
  Sep 17, 2024
• High 7.5
  CVE-2024-34351 Public exploit Scanner template

  Next.js Server-Side Request Forgery in Server Actions

  Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an …

  vercel next.js jitsucom-jitsu-console next Wolfi npm
  May 9, 2024