libretto v0.6.45

Libretto Libretto is a toolkit for building robust web integrations. It gives your coding agent a live browser and a token-efficient CLI to: Inspect live pages with minimal context overhead Capture network traffic to reverse-engineer site APIs Record user actions and replay them as automation...

vm2 v3.11.6

vm2 vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Important Security Disclaimer Before using vm2, you should understand how it works and its limitations. vm2 attempts to sandbox untrusted JavaScript code within the same Node.js process as your application...

Oracle Linux 8 : nodejs:24 (ELSA-2026-54371)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54371 advisory. - deps: update npm/brace-expansion to 5.9.0 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223388 RHEL-223907 RHEL-223792 - Backpo...

PT-2026-73048

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient validation or escaping of annotation fields written to disk via the 'setFileAnnotation' endpoint allows attackers to inject malicious markup. This markup executes as a script within the P...

CVE-2026-73041: Improper Neutralization of Input During Web Page Generation

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

GHSA-76PC-MQXP-3RQ5 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Unauthenticated Path Traversal in Dashboard Session Log API Endpoints | Field | Value | | ---------------- | ----- | | Repository | ooples/token-optimizer-mcp | | Affected version | 5.0.1 commit 8137147 | | Vulnerability | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory | |...

K000162928: Node.JS vulnerability CVE-2026-58043

Security Advisory Description A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended...

CVE-2026-73643

A flaw was found in js-yaml, a JavaScript YAML parser. A remote attacker could exploit this vulnerability by providing specially crafted YAML input containing nested flow collections. This can lead to exponential parsing time when the application processes untrusted input, consuming excessive CPU...

Linux Distros Unpatched Vulnerability : CVE-2026-73643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load o...

PT-2026-76576

Name of the Vulnerable Software and Affected Versions token-optimizer-mcp versions prior to 5.1.0 Description The dashboard HTTP server lacks authentication middleware for the '/api/session-summary' and '/api/session-events' endpoints, allowing any network-accessible client to access them without...

GHSA-M8MR-9HWF-7V3F

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

K000162921: Node.js vulnerability CVE-2026-58042

Security Advisory Description A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x. CVE-2026-58042...

K000162920: Node.js vulnerability CVE-2026-58041

Security Advisory Description A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using...

CVE-2026-73651

creationtimestamp| type| source ---|---|--- 2026-08-13 20:35:04+00:00| published-proof-of-concept| https://github.com/typeorm/typeorm/security/advisories/GHSA-2rp8-mm9q-fp49...

CVE-2026-73650

creationtimestamp| type| source ---|---|--- 2026-08-13 20:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msygo65aqv2u 2026-08-13 20:35:07+00:00| published-proof-of-concept| https://github.com/svg/svgo/security/advisories/GHSA-2p49-hgcm-8545...

Prototype Pollution

Overview browserslist is a Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset Affected versions of this package are vulnerable to Prototype Pollution via the normalizeStats function in node.js. An attacker can crash the process or alter an...

CVE-2026-73567

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by [email protected], which seeds an ARC4 strea...

DEBIAN-CVE-2026-73566

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname and no segment cap when tar.t... or tar.x... receives a non-empty member-selection list. A...

CVE-2026-73643

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...

CVE-2026-73650

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...