MongoDB 4.4.x < 4.4.31 / 5.0.x < 5.0.34 / 6.0.x < 6.0.29 / 7.0.x < 7.0.37 / 8.0.x < 8.0.26 / 8.2.x < 8.2.11 / 8.3.x < 8.3.4 Use-After-Free (CVE-2026-11933)

The version of MongoDB installed on the remote host is 4.4.x prior to 4.4.31, 5.0.x prior to 5.0.34, 6.0.x prior to 6.0.29, 7.0.x prior to 7.0.37, 8.0.x prior to 8.0.26, 8.2.x prior to 8.2.11, or 8.3.x prior to 8.3.4. It is, therefore, affected by a use-after-free vulnerability: - A use-after-fre...

PT-2026-49690

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 152 Thunderbird versions prior to 152 Description JIT miscompilation occurs in the JavaScript: WebAssembly component. Just-In-Time JIT compilation is a method used to improve the execution speed of programs by compili...

PT-2026-49825

Name of the Vulnerable Software and Affected Versions PowerSchool Employee Access Center version 23.10 Description Improper Neutralization of Input During Web Page Generation allows Cross-Site Scripting XSS, a flaw where malicious scripts are injected into otherwise trusted websites. An attacker...

PT-2026-49758

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.12 Description Exported session HTML preserves unsafe javascript: and data: links in generated content. This allows for the execution of browser-side scripts if a trusted operator opens the exported file and...

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Multiple security vulnerabilities in the Crawl4AI Docker API server affecting endpoints for crawling, markdown/LLM extraction, screenshots, PDFs, webhooks, monitoring, JavaScript execution, and configuration...

CVE-2026-48017

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...

EUVD-2026-37007

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /system/notice/add interface. An attacker can execute arbitrary JavaScript code in the context of a user's browser by injecting malicious scripts into input fields processed by this interface. Details...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /system/notice/add interface. An attacker can execute arbitrary JavaScript code in the context of a user's browser by injecting malicious scripts into input fields processed by this interface. Details...

CVE-2026-48887 WordPress JS Help Desk plugin <= 3.0.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in JS Help Desk = 3.0.9 versions...

CVE-2026-48887

CVE-2026-48887 affects the WordPress JS Help Desk plugin ≤ 3.0.9 with an unauthenticated Broken Access Control flaw. Documents note unauthorized access control weakness but do not provide root cause details or a stated remediation; Patchstack is cited as the source. Exploitation status is not des...

EUVD-2026-36861

Unauthenticated Broken Access Control in JS Help Desk = 3.0.9 versions...

CVE-2026-48886 WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability

Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...

EUVD-2026-36860

Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...

CVE-2026-48886

The CVE-2026-48886 entry describes an unauthenticated SQL Injection in WordPress JS Help Desk plugin versions

GHSA-9H5V-PFQQ-X599 UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

Summary A regular expression denial-of-service ReDoS vulnerability has been discovered in ua-parser-js when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParserheaders.withClientHints, an attacker can cause the parser to spend excessive CPU...

@aliceo2/bookkeeping (1.19.0), @aliceo2/infologger (>=1.16.0, <=1.18.0) +54 more potentially affected by CVE-2026-54270 via protobufjs (>=8.2.0, <=8.4.2)

protobufjs NPM version =8.2.0, =1.16.0, =0.1.0, =1.4.0-nightly.20261013021853, =0.14.1-nightly.20261013021853, =0.28.1-nightly.20261013021853, =0.0.1-evm.48, =0.0.1-evm.48, =0.1.0, =5.0.2, =0.1.0, =17.0.2 and more Source cves: CVE-2026-54270 Source advisory: SNYK:JS-PROTOBUFJS-17353318...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2223 more potentially affected by unknown CVE via dompurify (>=3.0.0, <=3.4.7)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =13.2.0, =16.2.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-DOMPURIFY-17342528...

10secondsofcode-custom (1.0.0), 1kohei1 (>=1.0.0, <=1.0.1) +8459 more potentially affected by CVE-2026-12143 via form-data (>=4.0.0, <=4.0.5)

form-data NPM version =4.0.0, =1.0.0, =1.2.0, =1.0.0, =0.1.0, =0.0.1, =0.1.1, =5.0.0, =0.0.1, =1.0.1, =1.0.32, =1.0.32, =1.1.11 and more Source cves: CVE-2026-12143 Source advisory: OSV:GHSA-HMW2-7CC7-3QXX...

CVE-2026-49294 Valhalla has reflected XSS via unsanitized JSONP callback parameter

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting XSS due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, t...