UBUNTU-CVE-2026-104269

GHSA-5pww-8rfg-9crf: RFC 2231 filename parameter bypasses multipart filename rules...

The vulnerability of the JSON processing library and stream-json, related to inadequate control over changes to prototype attributes, allows attackers to execute a “prototype pollution” attack.

The vulnerability of the JSON processing library and stream-json is related to inadequate control over changes to prototype attributes. Exploiting this vulnerability could allow an attacker to execute a “prototype pollution” attack...

ROOT-OS-DEBIAN-12-CVE-2026-102010 CVE-2026-102010 in gcc-12 - Patched by Root

Root has patched CVE-2026-102010 in the gcc-12 package for Root:Debian:12. Multiple fixed versions available...

external_expat_AOSP10_r33_CVE-2022-25236

Expat، الإصدار 2.2.6 هذه هي مكتبة Expat، وهي مكتبة بلغة C لتحليل XML، بدأها James Clark في عام 1997. Expat هي أداة تحليل XML موجهة للتيار stream-oriented. هذا يعني أنك تسجل معالجات handlers مع المحلل قبل بدء التحليل. يتم استدعاء هذه المعالجات عندما يكتشف المحلل الهياكل المرتبطة بها في المستند...

@0xsequence/codegenie (>=0.1.0, <=0.7.0), @2h2d/new (>=0.0.2, <=0.1.1-alpha.4) +1053 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.8.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =0.1.0, =1.0.0, =0.1.0, =4.10.0, =0.1.3, =0.1.0-beta.1, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R4XH-JQRQ-34V2...

EUVD-2026-90979

KaTeX: Existing prototype pollution can bypass trust restrictions...

CVE-2026-104712

A flaw was found in Apache Struts. An unauthenticated remote attacker could cause a Denial of Service DoS by sending requests with crafted decimal parameters that are rendered through the Struts tag library. Processing these values can produce disproportionately large server responses, enabling a...

@nx/express (>=23.0.0-beta.0, <=23.1.0), @nx/nest (>=23.0.0-beta.0, <=23.1.0) +1 more potentially affected by CVE-2026-104859 via @nx/docker (>=23.0.0, <=23.1.0-rc.3)

@nx/docker NPM version =23.0.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.1.0 Source cves: CVE-2026-104859 Source advisory: OSV:GHSA-6VC5-VF29-FFR2...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0-rc.87), @brabander/config-eslint (>=0.1.1, <=0.5.1) +175 more potentially affected by CVE-2026-104854 via nx (>=23.0.0, <=23.1.1)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.20.2, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.1.1 and more Source cves: CVE-2026-104854 Source advisory: OSV:GHSA-W3VV-58GJ-GW77...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0), @brabander/config-eslint (>=0.1.1, <=0.5.1) +177 more potentially affected by CVE-2026-104853 via nx (>=23.0.0, <=23.2.0-rc.2)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.4.0, =0.20.2, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.2.0 and more Source cves: CVE-2026-104853 Source advisory: OSV:GHSA-HRVQ-X7JP-36XV...

GHSA-8FXW-FMJ8-XP7J MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-75637

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-100723 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) potentially affected by CVE-2026-104871 via @angular/ssr (>=20.3.18, <=20.3.24)

@angular/ssr NPM version =20.3.18, =7.3.49-4369, =4.2.16-4435, =4.2.17 Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

3d-card (0.0.2), @cosla/sensemaking-web-ui (>=1.0.5, <=1.0.9) +19 more potentially affected by CVE-2026-104871 via @angular/ssr (>=19.0.5, <=19.2.27)

@angular/ssr NPM version =19.0.5, =1.0.5, =19.0.0-beta.1, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =0.0.2, =19.1.0, =16.0.0, =0.0.0, =0.0.0, =0.0.5 and more Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +2976 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-tedious (>=0.4.0, <=0.39.0)

@opentelemetry/instrumentation-tedious NPM version =0.4.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3312 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-pg (>=0.15.0, <=0.72.0)

@opentelemetry/instrumentation-pg NPM version =0.15.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3016 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-knex (>=0.27.1, <=0.64.0)

@opentelemetry/instrumentation-knex NPM version =0.27.1, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3007 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mongoose (>=0.31.0, <=0.66.0)

@opentelemetry/instrumentation-mongoose NPM version =0.31.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...