PT-2026-84843

Name of the Vulnerable Software and Affected Versions submariner affected versions not specified Description In cert-auth mode, the software builds connection configurations using free-form strings from the Custom Resource Definition CRD without proper validation. A malicious cluster can exploit...

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

This module creates permissions per node content type to control access to unpublished content. The module has allowed view access for published content, overriding other access mechanisms that might have been in place...

PT-2026-84896

Name of the Vulnerable Software and Affected Versions Unpublished Node Permissions versions 0.0.0 through 1.8.0 Description An incorrect authorization issue allows forceful browsing. The module, which manages permissions per node content type to control access to unpublished content, incorrectly...

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

Impact Two first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the Environment; neither is included in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. Applications that do not register...

Exploit for Eval Injection in Langflow

CVE-2025-62593 — Ray Unauthenticated RCE Exploit Overview...

MAL-2026-15813 Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

Allocation of Resources Without Limits or Throttling

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to Allocation of...

CLSA-2026-1788275913 Fix CVE(s): CVE-2025-24855

SECURITY UPDATE: use-after-free of the XPath context node - debian/patches/CVE-2025-24855.patch: restore the XPath context node after modifying it in libxslt/numbers.c, libxslt/templates.c and libxslt/xsltutils.c. - CVE-2025-24855...

DEBIAN-CVE-2026-83614

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

CVE-2026-83614

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

CVE-2026-83614 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

Malicious Package

Overview node-request-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview algol-stream-node-config-enif is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview algol-dione-markdown-io is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview alita-poke97 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

Linux Distros Unpatched Vulnerability : CVE-2026-83614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

CVE-2026-77856: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashtypescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. resolvetypedstructfield/2 in...

WS-2026-0048

node-mysql2 accepts a server-initiated switch to the mysqlclearpassword authentication plugin without requiring explicit opt-in, so the client transmits the password in plaintext. A malicious or DNS-hijacked server can request cleartext authentication and capture credentials even when the...