CVE-2026-104979 Plane: Cross-tenant stored XSS in intake enables account takeover

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-104979 Plane: Cross-tenant stored XSS in intake enables account takeover

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-104979

The open-source project management tool Plane is vulnerable to a cross-tenant stored XSS in versions prior to 1.4.0 . The root cause is that IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html via Issue.objects.create(...) without invoking validate_html_content from nh3 . This...

EUVD-2026-92538

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-104979 Plane: Cross-tenant stored XSS in intake enables account takeover

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

CVE-2026-104979: Improper Neutralization of Input During Web Page Generation

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes descriptionhtml through Issue.objects.create... without calling validatehtmlcontent from nh3. Any authenticated user, including a new user with no workspace memberships, can pla...

js-yaml: js-yaml: Denial of Service via crafted YAML merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker can exploit this vulnerability by providing a specially crafted YAML document that repeatedly uses the same alias in a merge sequence. This can lead to algorithmic CPU exhaustion, causing the Node.js worker or eve...

js-yaml: js-yaml: Denial of Service via crafted YAML ordered-map document

A flaw was found in js-yaml, a JavaScript YAML YAML Ain't Markup Language parser. An attacker could exploit this by providing a specially crafted YAML ordered-map document. This could lead to excessive CPU consumption, resulting in a denial of service DoS for applications processing the malicious...

js-yaml: js-yaml: Denial of Service via crafted YAML ordered-map document

A flaw was found in js-yaml, a JavaScript YAML YAML Ain't Markup Language parser. An attacker could exploit this by providing a specially crafted YAML ordered-map document. This could lead to excessive CPU consumption, resulting in a denial of service DoS for applications processing the malicious...

EUVD-2017-16788

Malware in sbrugna...

EUVD-2025-23575

Malicious code in bioql PyPI...

EUVD-2021-33028

Malicious code in bioql PyPI...

EUVD-2021-33024

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2017-7813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a...

CVE-2023-31913

Jerryscript 3.0 commit 1a2c047 was discovered to contain an Assertion Failure via the component parserparseclass at jerry-core/parser/js/js-parser-expr.c...

CVE-2023-34868

Jerryscript 3.0 commit 05dbbd1 was discovered to contain an Assertion Failure via the parserparseforstatementstart at jerry-core/parser/js/js-parser-statm.c...

UBUNTU-CVE-2024-33260

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component parserparseclass at jerry-core/parser/js/js-parser-expr.c...

PT-2024-25175 · Unknown · Jerryscript

Name of the Vulnerable Software and Affected Versions: Jerryscript version cefd391 Description: A segmentation violation was discovered in Jerryscript via the parser parse class component at jerry-core/parser/js/js-parser-expr.c. Recommendations: For Jerryscript version cefd391, consider...

Jsish 代码问题漏洞

Jsish is a small JavaScript parser written in C with a built-in database. A security vulnerability exists in Jsish v.3.0.11 and earlier versions, which stems from a vulnerability that allows an attacker to cause a denial of service via the JsiStrlen function...

SUSE CVE-2017-7813

Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a non-exploitable crash, but can leak a limited amount of information from memory if it matches JavaScript identifier syntax. This...