Malicious code in vite-svg-parse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6b581f4ab8d027c727649fae10749a9ac9a59af4619f5576362ab9243cb6c6 The package's exported API getPlugin/setPlugin decodes two base64 string literals at runtime: the first decodes to npm install node-internal-svg-load...

CVE-2025-15678

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files Author by default, allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site...

EUVD-2025-210624

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files Author by default, allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site...

CVE-2025-15678

The Nexter Blocks WordPress plugin, in versions prior to 5.0.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize uploaded SVG files , which allows any user with file upload permissions (such as the Author role by default) to upload a file containing ...

EulerOS 2.0 SP15 : emacs (EulerOS-SA-2026-2922)

According to the versions of the emacs package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG Scalable Vector...

CVE-2025-15678: Improper Neutralization of Input During Web Page Generation

The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload files Author by default, allowing them to upload a file containing malicious JavaScript that executes when the file is accessed, leading to Stored Cross-Site...

CVE-2026-16573

The Bit Form WordPress plugin, in versions prior to 3.2.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize uploaded signature images before storage, which allows unauthenticated attackers to upload a crafted SVG file containing malicious JavaScript . ...

EUVD-2026-53101

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting...

CVE-2026-16583 Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

EUVD-2026-53102

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

CVE-2026-16583 Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

CVE-2026-16583

The Orbit Fox WordPress plugin, versions before 3.0.8 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize uploaded SVG files when the plugin's SVG upload feature is enabled. This allows authenticated users with upload capabilities (such as Author level a...

CVE-2026-16573: Improper Neutralization of Input During Web Page Generation

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting...

CVE-2026-16583: Improper Neutralization of Input During Web Page Generation

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to trigger a service failure.

The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

MAL-2026-11769 Malicious code in @ornikar/react-native-svg-transformer (npm)

npm/@ornikar/react-native-svg-transformer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...

CLSA-2026-1773276768 TuxCare security update for phenx/php-svg-lib (3 CVEs)

TuxCare rebuilt phenx/php-svg-lib to address 3 CVEs. Fixed in 0.3.4-p1+tuxcare...

CLSA-2026-1775003203 TuxCare security update for is-svg (2 CVEs)

TuxCare rebuilt is-svg to address 2 CVEs. Fixed in 2.1.0-tuxcare.1...

Exploit for Improper Input Validation in Google Chrome

--- CVE-2026-11112 – XXE via SVG Image Upload Program C...

CVE-2026-13340

The SVG Support WordPress plugin before 2.5.17 does not apply its SVG sanitisation to uploaded files using the .svgz extension, even though it registers and serves them as SVG, allowing a user permitted to upload SVGs such as an Author once granted upload access to store a script-bearing file tha...