EUVD-2026-47687

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers...

CVE-2026-65598

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

webkit2gtk3 security update

An update is available for webkit2gtk3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list WebKitGTK is the port of the portable web rendering engine WebKit to the...

EUVD-2026-47642

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65598 n8n before 1.123.64 Remote Code Execution via Git Clone

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-65592 n8n before 1.123.64 Stored DOM XSS via cachedResultUrl

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open without scheme validation. An attacker with workflow creation/editing privileges can cra...

GHSA-PX8P-9VWX-VF98 fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

ROOT-APP-NPM-CVE-2019-16769 CVE-2019-16769 in @rootio/serialize-javascript - Patched by Root

Root has patched CVE-2019-16769 in the @rootio/serialize-javascript package for Root:npm. Multiple fixed versions available...

EUVD-2026-47320

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged...

SUSE CVE-2026-16355

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

SUSE CVE-2026-16363

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

SUSE CVE-2026-16368

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

SUSE CVE-2026-16369

Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

SUSE CVE-2026-16392

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

SUSE CVE-2026-16410

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

PT-2026-63498

Name of the Vulnerable Software and Affected Versions Regular Labs conditions manager affected versions not specified Description Stored condition values can be used to execute malicious HTML or JavaScript within administrator summaries. This is a Cross-Site Scripting XSS issue, where a script is...

PT-2026-63506

Name of the Vulnerable Software and Affected Versions Regular Labs extensions affected versions not specified Description Cross-site scripting XSS is possible through tag-provided custom HTML, module content or title overrides, and decoded modal or tooltip values. This allows a content author to...

PT-2026-63507

Name of the Vulnerable Software and Affected Versions Sourcerer extension affected versions not specified Description Multiple code injection vectors exist within the extension. The Free version fails to verify that both the article creator and the last modifier possess Super User privileges befo...

PT-2026-63475

Name of the Vulnerable Software and Affected Versions mongod affected versions not specified Description An authenticated user with read access can cause the mongod process to terminate. This occurs when specific aggregation expressions that execute server-side JavaScript are used, leading to...

CVE-2026-16630: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in syncfusion ej2-javascript-ui-controls up to 33.2.3. This affects the function childprocess.exec of the file package.json. The manipulation leads to os command injection. An attack has to be approached locally. The exploit has been disclosed publicly a...