ROOT-APP-NPM-CVE-2024-25466 CVE-2024-25466 in react-native-document-picker - Patched by Root

Root has patched CVE-2024-25466 in the react-native-document-picker package for Root:npm. Multiple fixed versions available...

PT-2026-83128

file picker aka flutter file picker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAY NAME obtained from ContentResolver.query directly in file path construction without...

CVE-2026-75917

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...

CVE-2026-75917

SiYuan before v3.7.4 contains an XSS-to-RCE vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()). Document metadata fields (bookmark, alias, memo, alternate name) are concatenated into the aria-label HTML attribute without escaping, a...

PT-2026-78383

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An issue exists in the file-tree picker's hover-tooltip generation within the getLeaf and movePathTo functions located in app/src/util/pathName.ts used by the 'move/link to' path-selection dialogs...

CVE-2026-75917: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...

MAL-2026-12130 Malicious code in accounts-card-design-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdaa2c933125ad6b8c88277ca7b778654f4a73bf7d6b1c9e945a4e9a2a80eed On require of the package's main, index.js loads platform.js, which fetches a platform-specific native binary from Cloudflare Workers hosts assembled...

Malicious Package

Overview beaver-ui-date-range-picker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in beaver-ui-date-range-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 744905f86e776fde6075a23e40274b0d4798bbb835114506926e0799430c24ba [email protected] declares a postinstall hook node setup.js and additionally triggers the same script from index.js via try...

Malicious Package

Overview nativescript-swisspost-imagepicker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CVE-2026-49274

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page...

EUVD-2026-42667

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page...

CVE-2026-49274

CVE-2026-49274 affects Kirby CMS prior to versions 4.9.4 and 5.4.4. When the pages field is used and a role has pages.access disabled, authenticated users could supply an inaccessible parent page or site to the page picker backend, enabling confirmation of page existence and retrieval of title fi...

CVE-2026-49274

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page...

CVE-2026-49274 Kirby: `pages.access` permission is not checked in the pages picker for parent pages

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page...

CVE-2026-49274 Kirby: `pages.access` permission is not checked in the pages picker for parent pages

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page...

CVE-2026-49274 Kirby: `pages.access` permission is not checked in the pages picker for parent pages

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page...

EUVD-2026-40948

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authenticated user can modify their group membership without proper authorization checks, allowing privilege escalation. An attacker can add themselves to arbitrar...

Malicious Package

Overview theme-color-picker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-6473 Malicious code in colorpicker-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 226e4e81049c5688a16a198fb9a90ab3d11d371b621e367da4590632f4e5e140 Package presents itself as a minimal React color-picker but ships a postinstall hook "postinstall": "node setup.js" that performs targeted credential...