@1771technologies/oneplay (>=0.0.1, <=0.0.6), @akiyamka/extended-fetch (0.0.8) +12 more potentially affected by CVE-2026-73653 via @vitest/browser (>=0.22.1, <=3.2.4)

@vitest/browser NPM version =0.22.1, =0.0.1, =2.1.0-alpha.249, =0.19.0-beta.2, =0.0.3-beta.0, =3.8.0, =1.0.1, =0.0.2, =1.1.8-rc.5, =0.0.3, =0.0.5 - strapi-plugin-vitest 0.1.8 - t-worker 1.1.0 Source cves: CVE-2026-73653 Source advisory: MEND:CVE-2026-73653...

CVE-2026-73653

Vitest (framework powered by Vite) has a vulnerability in Browser Mode provider commands prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6. The commands—upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces—accept browser-supplied file paths without enforcin...

@costrict/csc (>=4.1.7, <=4.2.42), @schalkneethling/calavera-baseline-core (>=0.2.0-next.2, <=0.2.0) +3 more potentially affected by CVE-2026-45819 via baseline-browser-mapping (>=2.8.4-beta3, <=2.10.43)

baseline-browser-mapping NPM version =2.8.4-beta3, =4.1.7, =0.2.0-next.2, =4.3.0, =4.3.2 Source cves: CVE-2026-45819 Source advisory: GHSA-W5VR-8V7Q-W6RV...

@costrict/csc (>=4.1.7, <=4.2.42), @schalkneethling/calavera-baseline-core (>=0.2.0-next.2, <=0.2.0) +3 more potentially affected by CVE-2026-45819 via baseline-browser-mapping (>=2.8.4-beta3, <=2.10.43)

baseline-browser-mapping NPM version =2.8.4-beta3, =4.1.7, =0.2.0-next.2, =4.3.0, =4.3.2 Source cves: CVE-2026-45819 Source advisory: OSV:GHSA-W5VR-8V7Q-W6RV...

GHSA-W5VR-8V7Q-W6RV baseline-browser-mapping process termination on invalid input causes denial of service

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

baseline-browser-mapping process termination on invalid input causes denial of service

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

CVE-2026-73611

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

CVE-2026-73612

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

CVE-2026-45819

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

EUVD-2026-57797

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

CVE-2026-73611 File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

CVE-2026-73612

CVE-2026-73612 affects File Browser prior to v2.63.22. The flaw is failing to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls by acting on an allowed parent directory. This enables copyin...

CVE-2026-73612 File Browser before v2.63.22 Authorization Bypass via Recursive Operations

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

CVE-2026-73612 File Browser before v2.63.22 Authorization Bypass via Recursive Operations

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

CVE-2026-73611 File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

EUVD-2026-57815

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

CVE-2026-73611

File Browser 2.50.0–2.63.21 does not validate JWT expiration when proxy authentication uses a non-default logout page. As a result, tokens remain valid and can access protected routes and administrative endpoints indefinitely; expired tokens can also be renewed to obtain fresh tokens via the rene...

CVE-2026-73611 File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...

EUVD-2026-57816

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

CVE-2026-73612 File Browser before v2.63.22 Authorization Bypass via Recursive Operations

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...