EUVD-2026-38806

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component...

CVE-2026-50710

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component...

CVE-2026-50711

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to improper neutralization of user-controlled input in the Number Card component...

CVE-2026-50710 Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config

A Stored Cross-Site Scripting XSS vulnerability exists in Frappe Framework version 17.0.0-dev due to unsafe evaluation of user-controlled data in the Number Card component...

PT-2026-51833

Name of the Vulnerable Software and Affected Versions Frappe Framework version 17.0.0-dev Description A Stored Cross-Site Scripting XSS issue occurs in the Number Card component when user-controlled data is unsafely evaluated. This happens specifically within the filters config variable, where th...

CVE-2026-44245

CVE-2026-44245 affects Kyverno’s policy-reporter-ui where the PropertyCard.vue component uses Vue.js v-html to render non-URL strings, bypassing escaping and allowing stored HTML payloads from Kubernetes PolicyReport.results[].properties to flow into the DOM. The isURL() guard only filters http/h...

Malicious code in identification-card-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08f07ce1c75c62d4d9c717c72e271cf8c7ff2c01ecfb240af7c2299c8c662f1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5561 Malicious code in identification-card-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08f07ce1c75c62d4d9c717c72e271cf8c7ff2c01ecfb240af7c2299c8c662f1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in identification-card-component

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in calendar-card-component

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in insights-card-component

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in meeting-card-component

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in new-items-card-component

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in meeting-card-component (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 388fc50b22e2990c5b37bcc9737237040efb41310d241da7e2dbb65c85a3717d Any computer that has this package installed or running should be considered...

Malicious code in new-items-card-component (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cffcddd91732bfca058bc61ed267aa0a24f1e71e7fcd830cf9060d8e63cd57fe Any computer that has this package installed or running should be considered...

MAL-2025-1209 Malicious code in calendar-card-component (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95a4969cc148bc29146d190547f35d8feedf6f215b80c642dc30147343561f09 Any computer that has this package installed or running should be considered...

Malicious code in calendar-card-component (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95a4969cc148bc29146d190547f35d8feedf6f215b80c642dc30147343561f09 Any computer that has this package installed or running should be considered...

MAL-2025-1223 Malicious code in meeting-card-component (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 388fc50b22e2990c5b37bcc9737237040efb41310d241da7e2dbb65c85a3717d Any computer that has this package installed or running should be considered...

MAL-2025-1220 Malicious code in insights-card-component (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82766b608d8923a399168c6fb9ea11a282a64d105b48fde50debc89d2ba1b82b Any computer that has this package installed or running should be considered...

MAL-2025-1225 Malicious code in new-items-card-component (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cffcddd91732bfca058bc61ed267aa0a24f1e71e7fcd830cf9060d8e63cd57fe Any computer that has this package installed or running should be considered...