CVE-2026-43898: Improper Control of Generation of Code

SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6, sandbox-defined functions expose Function.caller, allowing sandboxed code to recover the internal LispType.Call runtime callback. That callback can then be invoked with attacker-controlled fake context and obj values to extract blocked...

CVE-2026-47676: Inconsistent Interpretation of HTTP Requests

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the...

MAL-2026-5021 Malicious code in @mlspace/inference-build (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

RHEL 9 : firefox (RHSA-2026:21378)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:21378 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

Google Chrome Microsoft Edge Code Execution

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

Google Chrome Microsoft Edge Code Execution

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

Google Chrome Microsoft Edge Code Execution

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the ability to utilize memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

RHEL 10 : firefox (RHSA-2026:21380)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:21380 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Samsung Escargot security vulnerability

SAMSUNG Escargot is a memory-optimized JavaScript engine developed by South Korea’s Samsung Corporation. It is suitable for mid-range devices such as smartphones, tablets, and TVs. The version 36f5fb58366a67b713c02f6fd985e924fcc09e31 of SAMSUNG Escargot contains a security vulnerability caused by...

Sensorweb ScadaBR security vulnerability

Sensorweb ScadaBR is a set of open-source software developed by Sensorweb Corporation, designed for developing automated data acquisition and monitoring applications. There is a security vulnerability in Sensorweb ScadaBR. This vulnerability stems from an exposed method that allows authenticated...

PT-2026-44389

Name of the Vulnerable Software and Affected Versions TinyMCE versions 6.8.0 through 7.0.x Description An XSS Cross-Site Scripting issue exists due to improper SVG namespace scope handling within the sanitizer. An attacker can use a crafted payload with nested elements to bypass attribute...

Tiny Technologies TinyMCE Cross-site Scripting Vulnerability

TinyMCE is a rich text editor developed by Tiny Technologies in the United States. Versions of TinyMCE from 6.8.0 to 7.1.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper handling of SVG namespace scopes by the cleaner tool; it could allow custom payloads...

CTI-Transmute security vulnerabilities

CTI-Transmute is an open-source network threat intelligence format conversion service developed by the MISP Project. CTI-Transmute has a security vulnerability. This vulnerability stems from the fact that the notification messages in the notification panel contain transition names that are...

CVE-2026-47675: Improper Neutralization of CRLF Sequences in HTTP Headers

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the serialize function in hono/cookie validates domain and path options against characters that corrupt Set-Cookie header syntax ;, \r, \n, but does not apply the same validation to sameSite an...

PT-2026-44538

Name of the Vulnerable Software and Affected Versions ScadaBR version 1.2.0 Description Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. These scripts execute with full access, enabling complete system compromise as commands are executed as...

PT-2026-44211

A stored cross-site scripting XSS vulnerability exists in the notification panel of CTI Transmute in versions prior to the patched release. Notification messages containing user-controlled convert names were rendered in the notification bell dropdown using innerHTML without adequate sanitization...

PT-2026-118195

Уязвимость обработчика JavaScript-сценариев V8 браузеров Google Chrome и Microsoft Edge связана с небезопасным управлением привилегиями. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

Linux Distros Unpatched Vulnerability : CVE-2026-44903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI enable...

AlmaLinux 8 : .NET 8.0 (ALSA-2026:21291)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:21291 advisory. serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization CVE-2026-34043 dotnet: .NET: infinite...