Joern 4.0.593

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CVE-2026-46594: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...

Node.js Brace Expansion Resource Consumption DoS

The vulnerability of the brace-expansion library on the Node.js software platform is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

DOMPurify Code Execution

The vulnerability of the FORBIDTAGS function in the JavaScript library for secure cleaning and protection of HTML code by DOMPurify is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

JavaScript Serialization Uncontrolled Resource Consumption DoS

The vulnerability of the library for serializing JavaScript objects into a string format is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

📄 DbGate 7.1.8 Remote Code Execution

A proof of concept exploit for a DbGate 7.1.8 unauthenticated remote code execution vulnerability. The exploit abuses the /runners/start endpoint by injecting JavaScript through the JSON script runner's functionName field, allowing arbitrary operating system commands to be executed and their outp...

Alt-N MDaemon 20.0.x < 20.0.9 / 21.0.x < 21.0.8 / 21.5.x < 21.5.6 / 22.0.x < 22.0.7 / 23.0.x < 23.0.4 / 23.5.x < 23.5.5 / 24.0.x < 24.0.4 / 24.5.x < 24.5.3 / 25.0.x < 25.0.3 Stored XSS

The remote Windows host is running a version of MDaemon Email Server that is affected by a stored cross-site scripting XSS vulnerability. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript cod...

GitLab 14.0 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-3093)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker t...

CVE-2026-52232

A reflected cross-site scripting XSS vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

PT-2026-66699

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfiltered html capability to store JavaScript that runs...

PT-2026-66848

Name of the Vulnerable Software and Affected Versions Jodit Editor versions prior to 4.12.31 Description The sanitizeHTMLElement function fails to properly normalize javascript: values within href attributes before validating the scheme. While other URL attributes are processed using the...

CVE-2026-59232: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through...

Thymeleaf Expression Language XSS

The vulnerability of the JavaScript-based Thymeleaf engine is related to the lack of measures taken to neutralize special elements used in the expression language operator. Exploiting this vulnerability can allow a remote attacker to bypass existing security mechanisms...

CVE-2026-17658

An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523030583...

CVE-2026-17807

An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=516763884...

CVE-2026-17952

An inappropriate implementation flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517316174...

CVE-2026-17920

An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513413942...

CVE-2026-17836

An use after free flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517972812...

Malicious code in 1apijs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2700f92a449d39fb0881259de81734a6c2f7933dad7e567fd4284e58b6fe062 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

leanplum-sdk (1.13.0) potentially affected by CVE-2025-51684 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2025-51684 Source advisory: SNYK:JS-CLEVERTAPWEBSDK-18508175...