9router-pro (0.5.109-pro.11), @_sh/strapi-plugin-ckeditor (8.0.0) +1220 more potentially affected by CVE-2026-109345 via dompurify (>=3.4.0, <=3.4.15)

dompurify NPM version =3.4.0, =0.0.1, =0.1.0, =0.10.2, =0.1.0-alpha.36, =0.1.0, =6.3.4, =0.1.0, =6.4.40, =0.13.1, =0.2.0, =5.52.1-fa.2, =5.52.1-fa.6 and more Source cves: CVE-2026-109345 Source advisory: MEND:CVE-2026-109345...

CVE-2026-107731

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-107731 SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-107731

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-107731 SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

EUVD-2026-95403

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-107731

The multi-format reader SumatraPDF version 3.7.0.22298 for Windows contains four independently reachable range-validation flaws in src/LitDoc.cpp . These flaws allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. Specifically, th...

CVE-2026-107731 SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-107730 SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...

PT-2026-108292

Name of the Vulnerable Software and Affected Versions SumatraPDF version 3.7.0.22298 Description Four range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations...

CVE-2026-107731: Out-of-bounds Read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

Malicious code in epic-lit-media-query (npm)

--- Credit: OpenSSF source...

Malicious code in da-lit (npm)

Source: amazon-inspector 9a04774b86c8891b58af17e5af350189f9eccba16758e14dd16e152dcd3e0bb7 The package da-lit was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cash-app-money-generator-new-updated-2023-nhfy702r-lit (npm)

--- Credit: OpenSSF source...

Malicious code in @zalastax/nolb-lion-lit (npm)

The package @zalastax/nolb-lion-lit was found to contain malicious code. --- Credit: OpenSSF source...

dictatorgenai (0.1.0), lit-data-layers (>=0.1.0, <=0.1.4) potentially affected by CVE-2026-22219 via chainlit (1.3.2)

chainlit PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - dictatorgenai 0.1.0 - lit-data-layers =0.1.0, =0.1.4 Source cves: CVE-2026-22219 Source advisory: OSV:PYSEC-2026-1237...

dictatorgenai (0.1.0), lit-data-layers (>=0.1.0, <=0.1.4) potentially affected by CVE-2025-68492 via chainlit (1.3.2)

chainlit PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - dictatorgenai 0.1.0 - lit-data-layers =0.1.0, =0.1.4 Source cves: CVE-2025-68492 Source advisory: OSV:PYSEC-2026-1238...

dictatorgenai (0.1.0), lit-data-layers (>=0.1.0, <=0.1.4) potentially affected by CVE-2026-56104 via chainlit (1.3.2)

chainlit PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - dictatorgenai 0.1.0 - lit-data-layers =0.1.0, =0.1.4 Source cves: CVE-2026-56104 Source advisory: OSV:GHSA-C39V-8HRW-H448...

Malware in lit-a11y

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in lit-a11y (npm)

The package 'lit-a11y' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.com...