EUVD-2026-90979

KaTeX: Existing prototype pollution can bypass trust restrictions...

CVE-2026-104712

A flaw was found in Apache Struts. An unauthenticated remote attacker could cause a Denial of Service DoS by sending requests with crafted decimal parameters that are rendered through the Struts tag library. Processing these values can produce disproportionately large server responses, enabling a...

@nx/express (>=23.0.0-beta.0, <=23.1.0), @nx/nest (>=23.0.0-beta.0, <=23.1.0) +1 more potentially affected by CVE-2026-104859 via @nx/docker (>=23.0.0, <=23.1.0-rc.3)

@nx/docker NPM version =23.0.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.1.0 Source cves: CVE-2026-104859 Source advisory: OSV:GHSA-6VC5-VF29-FFR2...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0-rc.87), @brabander/config-eslint (>=0.1.1, <=0.5.1) +175 more potentially affected by CVE-2026-104854 via nx (>=23.0.0, <=23.1.1)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.20.2, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.1.1 and more Source cves: CVE-2026-104854 Source advisory: OSV:GHSA-W3VV-58GJ-GW77...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0), @brabander/config-eslint (>=0.1.1, <=0.5.1) +177 more potentially affected by CVE-2026-104853 via nx (>=23.0.0, <=23.2.0-rc.2)

nx NPM version =23.0.0, =1.0.0-rc.24, =0.1.1, =1.0.0-alpha.0, =0.3.1, =1.0.0-rc.39, =0.0.2-10, =1.1.0-alpha.3, =0.4.0, =0.20.2, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.2.0 and more Source cves: CVE-2026-104853 Source advisory: OSV:GHSA-HRVQ-X7JP-36XV...

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

EUVD-2026-75637

MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs...

GHSA-8FXW-FMJ8-XP7J MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

Impact Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-100723 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) potentially affected by CVE-2026-104871 via @angular/ssr (>=20.3.18, <=20.3.24)

@angular/ssr NPM version =20.3.18, =7.3.49-4369, =4.2.16-4435, =4.2.17 Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

3d-card (0.0.2), @cosla/sensemaking-web-ui (>=1.0.5, <=1.0.9) +19 more potentially affected by CVE-2026-104871 via @angular/ssr (>=19.0.5, <=19.2.27)

@angular/ssr NPM version =19.0.5, =1.0.5, =19.0.0-beta.1, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =0.0.2, =19.1.0, =16.0.0, =0.0.0, =0.0.0, =0.0.5 and more Source cves: CVE-2026-104871 Source advisory: OSV:GHSA-7G7C-H8RR-7P6Q...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +2976 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-tedious (>=0.4.0, <=0.39.0)

@opentelemetry/instrumentation-tedious NPM version =0.4.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3312 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-pg (>=0.15.0, <=0.72.0)

@opentelemetry/instrumentation-pg NPM version =0.15.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3016 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-knex (>=0.27.1, <=0.64.0)

@opentelemetry/instrumentation-knex NPM version =0.27.1, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3007 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mongoose (>=0.31.0, <=0.66.0)

@opentelemetry/instrumentation-mongoose NPM version =0.31.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

0perator (>=0.1.0, <=0.3.0), @0xchain/telemetry (>=0.0.1, <=1.1.0-beta.8) +3073 more potentially affected by CVE-2026-104872 via @opentelemetry/instrumentation-mysql (>=0.15.0, <=0.66.0)

@opentelemetry/instrumentation-mysql NPM version =0.15.0, =0.1.0, =0.0.1, =3.11.1, =0.0.53, =0.0.31, =0.8.0, =0.1.0, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.3.702, =0.0.65, =0.2.0, =0.2.0, =0.0.1, =0.0.5 and more Source cves: CVE-2026-104872 Source advisory:...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @1-/fix (>=0.1.4, <=0.1.10) +465 more potentially affected by CVE-2026-104848 via tinypool (>=2.0.0, <=2.1.0)

tinypool NPM version =2.0.0, =0.0.1, =0.1.4, =15.0.0, =1.57.7, =1.3.0, =3.0.0-next-3def11e, =0.0.0-next.d8e717b, =2.23.0, =0.0.1, =1.0.0, =0.6.0-alpha.26, =0.6.0-alpha.26, =1.1.0, =0.4.0, =1.0.0-rohit-ds-tokens-and-primitives.1 and more Source cves: CVE-2026-104848 Source advisory:...

authowl (>=0.3.0, <=0.3.12), quicktype (>=26.0.0-pre1, <=26.0.0) +1 more potentially affected by CVE-2026-104183 via stream-json (3.5.0)

stream-json NPM version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on stream-json and may be impacted: - authowl =0.3.0, =26.0.0-pre1, =0.1.0, =0.1.1 Source cves: CVE-2026-104183 Source advisory: OSV:GHSA-MJW6-4JJ6-33HC...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +294 more potentially affected by CVE-2026-92959 via vm2 (>=3.0.0, <=3.11.6)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@dataform/cli (>=3.0.57, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +22 more potentially affected by CVE-2026-92936 via vm2 (>=3.11.1, <=3.11.6)

vm2 NPM version =3.11.1, =3.0.57, =0.1.0, =2.32.0, =0.0.16, =1.4.13, =1.0.0, =1.1.0, =0.2.0, =1.0.0, =3.1.3, =2.32.0, =1.72.3, =2.0.9 and more Source cves: CVE-2026-92936 Source advisory: OSV:GHSA-X6M4-CHR9-CG97...