CVE-2026-24474

Summary: CVE-2026-24474 affects the Dioxus Components library (shadcn-style components for the Dioxus app framework). Prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a, the function/use_animated_open formats a string for eval using a user-supplied id, enabling a potential JavaScript inject...

CVE-2026-24474 Dioxus Components has JavaScript injection via user-supplied IDs

Dioxus Components is a shadcn-style component library for the Dioxus app framework. Prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a, useanimatedopen formats a string for eval with an id that can be user supplied. Commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a patches the issue...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell PoC This repository provides a minimal intentiona...

Exploit for Deserialization of Untrusted Data in Facebook React

🔍 Next.js Security Testing Tool Professiona...

Arbitrary Code Injection

Overview langflow is an A Python package with a built-in web application Affected versions of this package are vulnerable to Arbitrary Code Injection via the handling of Python function components. An attacker can execute arbitrary code by introducing custom Python code into a workflow. Remediati...

Arbitrary Code Injection

Overview lfx is a lfx is a command-line tool for running Langflow workflows. It provides two main commands: serve and run. Affected versions of this package are vulnerable to Arbitrary Code Injection via the handling of Python function components. An attacker can execute arbitrary code by...

CVE-2026-0771 Langflow PythonFunction Code Injection Remote Code Execution Vulnerability

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The specific flaw exis...

CVE-2026-0771

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The specific flaw exis...

Malicious code in kwp-shared-components-production-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b2bf82ab1e7b02c2c3398dc73b6c1635e7f3e8da7f0a3aa11123d5db5a19b56 The package kwp-shared-components-production-system was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-4526

Malicious code in kwp-shared-components-production-system npm...

MAL-2026-480 Malicious code in kwp-shared-components-production-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b2bf82ab1e7b02c2c3398dc73b6c1635e7f3e8da7f0a3aa11123d5db5a19b56 The package kwp-shared-components-production-system was found to contain malicious code. Source: ghsa-malware...

PT-2026-4539

Dioxus Components is a shadcn-style component library for the Dioxus app framework. Prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a, use animated open formats a string for eval with an id that can be user supplied. Commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a patches the issue...

Anritsu ShockLine: Competition condition issue vulnerability

Anritsu ShockLine is a series of vector network analyzers produced by Anritsu Corporation in Japan. Anritsu ShockLine has a vulnerability related to race conditions, which arises due to insufficient locking during object operations involving SCPI components. This vulnerability may lead to race...

com.almis.awe:awe-annotation (>=4.10.11 <=4.11.2), com.almis.awe:awe-annotations-spring-boot-starter (>=4.10.11 <=4.11.2) +107 more potentially affected by CVE-2025-22234 via org.springframework.security:spring-security-core (=6.3.8)

org.springframework.security:spring-security-core MAVEN version =6.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.almis.awe:awe-annotation =4.10.11, =4.10.11, =4.10.11,...

EUVD-2026-4190

Malicious code in @mailpoet/components npm...

Malicious code in @mailpoet/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ec1e0266ccd0888d11f208447e31b521c1d6a2d7e622b0b78d7572b5f6e8b3e The package @mailpoet/components was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview @mailpoet/components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-455 Malicious code in @mailpoet/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ec1e0266ccd0888d11f208447e31b521c1d6a2d7e622b0b78d7572b5f6e8b3e The package @mailpoet/components was found to contain malicious code. Source: ghsa-malware...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. Security...

[SECURITY] Fedora 43 Update: mariadb11.8-11.8.5-1.fc43

MariaDB is a community developed fork from MySQL - a multi-user, multi-thread ed SQL database server. It is a client/server implementation consisting of a server daemon mariadbd and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs...