Security Bulletin: Carbon design system packages

Summary Various packages are vulnerable to multiples CVEs and can be resolved by updating to [email protected], @carbon/[email protected], @carbon/[email protected], @carbon/[email protected], @carbon/[email protected], @carbon/[email protected], @carbon/[email protected], @carbon/[email protected]....

Linux Distros Unpatched Vulnerability : CVE-2024-43805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on us...

Linux Distros Unpatched Vulnerability : CVE-2017-5064

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect handling of DOM changes in Blink in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially exploit heap corruption v...

CVE-2025-8451 Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘data-gallery-items’ parameter in all versions up to, and including, 6.2.2 due to insufficient input sanitization and output escaping. Thi...

Malicious code in ac-dom-metrics (npm)

The package ac-dom-metrics was found to contain malicious code...

Malicious code in style-dom (npm)

The package style-dom was found to contain malicious code...

Malicious code in chimera-dom (npm)

The package chimera-dom was found to contain malicious code...

Malicious code in react-dom.js (npm)

The package react-dom.js was found to contain malicious code...

MAL-2025-25996 Malicious code in matches-dom-selector (npm)

The package matches-dom-selector was found to contain malicious code...

MAL-2025-31853 Malicious code in react-router-dom-5 (npm)

The package react-router-dom-5 was found to contain malicious code...

MAL-2025-25546 Malicious code in logrocket-dom (npm)

The package logrocket-dom was found to contain malicious code...

MAL-2025-17869 Malicious code in cycle-monorepo-sandbox-dom (npm)

The package cycle-monorepo-sandbox-dom was found to contain malicious code...

MAL-2025-13966 Malicious code in ac-dom-metrics (npm)

The package ac-dom-metrics was found to contain malicious code...

MAL-2025-19756 Malicious code in eract-dom (npm)

The package eract-dom was found to contain malicious code...

Malicious code in cycle-monorepo-sandbox-dom (npm)

The package cycle-monorepo-sandbox-dom was found to contain malicious code...

Malicious code in react-router-dom-5 (npm)

The package react-router-dom-5 was found to contain malicious code...

Malicious code in ac-dom-traversal (npm)

The package ac-dom-traversal was found to contain malicious code...

MAL-2025-13965 Malicious code in ac-dom-emitter (npm)

The package ac-dom-emitter was found to contain malicious code...

delegate-dom (>=0.0.0, <=0.0.1), dom-delegation-stream (0.0.0) +2 more potentially affected by unknown CVE via matches-dom-selector (0.0.0)

matches-dom-selector NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on matches-dom-selector and may be impacted: - delegate-dom =0.0.0, =1.0.0, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: OSV:MAL-2025-25996...

domquery (>=1.0.0, <=1.0.1), hide (0.0.0) +3 more potentially affected by unknown CVE via style-dom (>=0.0.0, <=2.0.0)

style-dom NPM version =0.0.0, =1.0.0, =0.0.0, =0.0.2, =0.0.0, =0.0.1 Source cves: unknown CVE Source advisory: OSV:MAL-2025-34114...