CVE-2026-32119

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored XSS in the jQuery SearchHighlight plugin library/js/SearchHighlight.js allows an authenticated user with encounter form write access to inject arbitrary...

CVE-2026-32119 OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored XSS in the jQuery SearchHighlight plugin library/js/SearchHighlight.js allows an authenticated user with encounter form write access to inject arbitrary...

@kids-reporter/cms-core (>=1.0.17, <=1.0.36), @kids-reporter/draft-editor (>=1.0.19, <=1.0.36) potentially affected by CVE-2026-33326 via @keystone-6/core (6.5.1)

@keystone-6/core NPM version 6.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @kids-reporter/cms-core =1.0.17, =1.0.19, =1.0.36 Source cves: CVE-2026-33326 Source advisory: OSV:GHSA-CGCG-Q9JH-5PR2...

EUVD-2025-208863

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in WPSight WPCasa allows DOM-Based XSS.This issue affects WPCasa: from n/a through 1.4.1...

CVE-2025-62043

CVE-2025-62043: WPCasa WordPress plugin is affected up to version 1.4.1 by a DOM-based XSS due to improper neutralization of input during web page generation. The vulnerability affects WPCasa (and related WPSight/WPCasa references) with a CVSS v3.1 base score of 6.5 (Medium) and requires user int...

Vulnerability of the DOM component: The security features of Mozilla Firefox, Firefox ESR, and the email client Thunderbird allow attackers to circumvent existing security restrictions.

The vulnerability of the DOM component: The security of Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass existing security restrictions remotely...

JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)

Summary Sanitized DOM trees can be unsafe to serialize when a custom policy allows raw-text elements such as or . The issue affects DOM trees that are constructed or modified programmatically and then passed through sanitizedom with a policy that keeps these elements. Text nodes inside and are...

GHSA-QVC2-MG72-JJHX JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)

Summary Sanitized DOM trees can be unsafe to serialize when a custom policy allows raw-text elements such as or . The issue affects DOM trees that are constructed or modified programmatically and then passed through sanitizedom with a policy that keeps these elements. Text nodes inside and are...

OPENSUSE-SU-2026:20391-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Changes in MozillaThunderbird: - Mozilla Thunderbird 140.8.1 ESR Add mail.openpgp.loaduntestedgpgmeversion to load untested GPGME version - Mozilla Thunderbird 140.8.0 ESR MFSA 2026-17 boo1258568 CVE-2026-2757 bmo2001637 Incorrect...

org.webjars.npm:dom-to-pdf (0.3.2), org.webjars.npm:html2pdf.js (>=0.10.1, <=0.10.3) potentially affected by CVE-2026-31938 via org.webjars.npm:jspdf (>=2.5.2, <=3.0.3)

org.webjars.npm:jspdf MAVEN version =2.5.2, =0.10.1, =0.10.3 Source cves: CVE-2026-31938 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15678196...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +9 more potentially affected by CVE-2026-31938 via jspdf (>=4.0.0, <=4.2.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.3 - svgedit 7.4.1 Source cves: CVE-2026-31938 Source advisory: OSV:GHSA-WFV2-PWC8-CRG5...

org.webjars.npm:dom-to-pdf (0.3.2), org.webjars.npm:html2pdf.js (>=0.10.1, <=0.10.3) potentially affected by CVE-2026-31898 via org.webjars.npm:jspdf (>=2.5.2, <=3.0.3)

org.webjars.npm:jspdf MAVEN version =2.5.2, =0.10.1, =0.10.3 Source cves: CVE-2026-31898 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15677843...

Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML.init always reaches TreeBuilder.finish, which unconditionally calls populateselectedcontent. That function recursively traverses the DOM via findelements / findelement without a depth bound,...

GHSA-V7CF-C9RM-WM3J Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Summary justhtml through 1.9.1 allows denial of service via deeply nested HTML. During parsing, JustHTML.init always reaches TreeBuilder.finish, which unconditionally calls populateselectedcontent. That function recursively traverses the DOM via findelements / findelement without a depth bound,...

Malicious code in graphql-request-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12e85257ce18204d98a8a6181fa40a75d7feb91477b98f6b86ba89223a9f4e51 The package graphql-request-dom was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview graphql-request-dom is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1444 Malicious code in graphql-request-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12e85257ce18204d98a8a6181fa40a75d7feb91477b98f6b86ba89223a9f4e51 The package graphql-request-dom was found to contain malicious code. Source: ghsa-malware...

EulerOS Virtualization 2.10.1 : python3 (EulerOS-SA-2026-1542)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory EOCD Locator record offset value would not...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2026-1376)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When building nested elements using xml.dom.minidom methods such as appendChild that have a dependency on clearidcache the algorithm is quadratic...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2026-1407)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When building nested elements using xml.dom.minidom methods such as appendChild that have a dependency on clearidcache the algorithm is quadratic...