@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-41478 via @saltcorn/mobile-app (>=1.5.0-beta.0, <=1.5.5)

@saltcorn/mobile-app NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNMOBILEAPP-16110990...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.4), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.4) potentially affected by CVE-2026-41478 via @saltcorn/mobile-app (>=1.6.0-alpha.0, <=1.6.0-beta.4)

@saltcorn/mobile-app NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.4 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNMOBILEAPP-16110990...

SQL Injection

Overview @saltcorn/mobile-app is a Saltcorn mobile app for Android and iOS Affected versions of this package are vulnerable to SQL Injection via the getSyncRows and getDelRows functions. An attacker can execute arbitrary SQL commands, exfiltrate sensitive data, modify or delete database contents,...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-41423 via @angular/platform-server (>=21.1.2, <=21.2.0)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-41423 Source advisory: GHSA-45Q2-GJVG-7973...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-41423 via @angular/platform-server (>=21.1.2, <=21.2.0)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-41423 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-16097942...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-41423 via @angular/platform-server (>=21.1.2, <=21.2.0)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

GHSA-533Q-W4G6-5586 PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart

Summary The upload PATCH flow under /files/:uploadId validates the mounted request path using the still-encoded req.path, but the downstream tus handler later writes using the decoded req.params.uploadId. In deployments that use a supported custom PSITRANSFERUPLOADDIR whose basename prefixes a...

CVE-2026-33083

creationtimestamp| type| source ---|---|--- 2026-04-16 20:58:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjncfmmcg22r 2026-04-17 05:18:08+00:00| published-proof-of-concept| Telegram/MfRD7ll8pGcGi3RGemlsgII30sQ-Y2l5bpdSqMK2BdYlKE 2026-04-20 22:00:28+00:00| seen|...

Europe’s Online Age Verification App Is Here

Available for free to any company that wants to use it, the “completely anonymous” app puts the pressure on porn sites and social media platforms to start blocking access by minors...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoriong operands are vulnerable to cross-site scripting (GHSA-h8r8-wccr-v5f2, GHSA-cjmm-f4jc-qw8r) and prototype polution (GHSA-cj63-jhhr-wcxv)

Summary Node.js module dompurify is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to cross-site scripting GHSA-h8r8-wccr-v5f2, GHSA-cjmm-f4jc-qw8r and prototype polution GHSA-cj63-jhhr-wcxv. This...

EUVD-2026-23196

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs, potentially causing the iOS device to become temporarily inoperable...

CVE-2026-1620

creationtimestamp| type| source ---|---|--- 2026-04-16 09:16:03+00:00| seen| Telegram/yXoKEH-Nbvx8vVZVETbcb5fnBU2DfxjhcC8NzdaVOFnAe1M 2026-04-16 11:08:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjmbhxfs342q...

CVE-2026-3861

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...

CVE-2026-3861

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...

CVE-2026-3861

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...

CVE-2026-3861

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...

[SECURITY] Fedora 42 Update: perl-PAR-Packer-1.064-3.fc42

This module implements the App::Packer::Backend interface, for generating stand-alone executables, perl scripts and PAR files...

CVE-2026-4880

creationtimestamp| type| source ---|---|--- 2026-04-16 00:00:41+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mjl44xsviz2c 2026-04-16 00:00:41+00:00| seen| https://infosec.exchange/users/offseq/statuses/116411442042183112 2026-04-16 02:17:40+00:00| seen|...

PT-2026-33270

Name of the Vulnerable Software and Affected Versions LINE client for iOS versions prior to 26.3.0 Description An issue exists in the in-app browser where opening a specially crafted web page can repeatedly trigger OS-level dialogs. This behavior can lead to a denial of service, potentially causi...

CVE-2026-4880: Improper Privilege Management

The Barcode Scanner +Mobile App – Inventory manager, Order fulfillment system, POS Point of Sale plugin for WordPress is vulnerable to privilege escalation via insecure token-based authentication in all versions up to, and including, 1.11.0. This is due to the plugin trusting a user-supplied...