NPM: toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

NPM: toml-node: Uncontrolled resource consumption CPU DoS via unbounded-length integer literals in toml.parse vulnerability discovered by ? in WordPress npm toml versions = 5.0.0...

Emojify

Emojify 🔋⌚🐆💀 ⌛ 🌵 🌵 🌈 🍡 🥚 👖 👢🎹🎹 🍬 🌽 🔋 🍟🔨 🔑🍟 🚀 🍭 🗼 🎍 💄 🍬🌽 ⌛🌷💀 🌵 🚬 🌵 ⚽ 🎱 🥚 👖 👢🎹🎹 🚩 🔋 🍟 🍟 🎱 ⚽ 🗼 🎍 💄 🎌 ⌛ 🌵 🌵 🍭 🔪 👝 🥚 👖 👢 🏁 🔋⌚🐆💀 🍟 🍟 🔪🏈 🎽💼🗼 🎍 💄 🚩 Obfuscates charcater and string literals into emojis and randomises classes, interfaces, methods and variable names. NB Inherited, overriden and implemented...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals

A flaw was found in the html/template package in Go. This vulnerability allows a remote attacker to conduct cross-site scripting XSS, an attack that executes malicious scripts in a user's browser through improper output escaping. When a JavaScript template literal contains consecutive expressions...

CLSA-2026-1792502898 TuxCare security update for @babel/plugin-transform-literals (1 CVE)

TuxCare rebuilt @babel/plugin-transform-literals to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792502896 TuxCare security update for @babel/plugin-transform-literals (1 CVE)

TuxCare rebuilt @babel/plugin-transform-literals to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792502893 TuxCare security update for @babel/plugin-transform-literals (2 CVEs)

TuxCare rebuilt @babel/plugin-transform-literals to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792502892 TuxCare security update for @babel/plugin-transform-literals (1 CVE)

TuxCare rebuilt @babel/plugin-transform-literals to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792283519 TuxCare security update for @babel/plugin-transform-template-literals (2 CVEs)

TuxCare rebuilt @babel/plugin-transform-template-literals to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792283517 TuxCare security update for @babel/plugin-transform-template-literals (1 CVE)

TuxCare rebuilt @babel/plugin-transform-template-literals to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792283512 TuxCare security update for @babel/plugin-transform-template-literals (1 CVE)

TuxCare rebuilt @babel/plugin-transform-template-literals to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792283511 TuxCare security update for @babel/plugin-transform-template-literals (1 CVE)

TuxCare rebuilt @babel/plugin-transform-template-literals to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

Astra Linux – Vulnerability in Zabbix

Templates do not properly handle backticks as JavaScript string delimiters, and do not escape them as expected. Backticks have been used since ES6 for JavaScript template literals. If a template contains a Go template action within a JavaScript template literal, the contents of the action can be...

CLEANSTART-2026-NE60365 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...