957 matches found
CVE-2026-104844
A flaw was found in postcss-selector-parser. A remote attacker could exploit this vulnerability by submitting a specially crafted CSS selector containing numerous class or ID identifiers to an application that parses untrusted input. Due to inefficient processing and repeated scanning during...
CVE-2026-104844
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...
CVE-2026-104844
The PostCSS Selector Parser (prior to version 7.1.6 ) is vulnerable to a Denial of Service (DoS) attack due to quadratic complexity in flat selector parsing. The root cause lies in src/parser.js, where splitWord() accepts selectors with numerous class or ID indexes because period and hash charact...
CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...
EUVD-2026-91741
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...
CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifical...
Security Bulletin: Vulnerabilities in Netty,Apache Log4j Core,Spring Boot,Spring Framework,PostCSS,tmp,Spring Data,Apache Commons Lang,React Router,Bootstrap,d3-color might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Apache Log4j Core, Spring Boot, Spring Framework, PostCSS, tmp, Spring Data, Apache Commons Lang, React Router, Bootstrap,d3-color. Vulnerabilities include The attacker can present a server certificate...
Security Bulletin: Vulnerabilities in Netty,Spring Boot,ZDRES-232,Apache HttpComponents,Spring Security,PostCSS,spring-cloud-gateway-server might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Spring Boot, ZDRES-232, Apache HttpComponents,Spring Security, PostCSS,spring-cloud-gateway-server. Vulnerabilities include attacker supplies com.myapp.SomeClass causes clinit of SomeClass â€" and many...
Security Bulletin: IBM Maximo Application Suite uses postcss-8.5.10.tgz which is vulnerable to CVE-2026-69153.
Summary IBM Maximo Application Suite uses postcss-8.5.10.tgz which is vulnerable to CVE-2026-69153. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-69153 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and...
Security Bulletin: : IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.
Summary IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities. The CVE details are listed in the Vulnerability Details section below. This bulletin provides information about the affected components and the...
CLSA-2026-1790604941 TuxCare security update for postcss (6 CVEs)
TuxCare rebuilt postcss to address 6 CVEs. Fixed in 6.0.1-tuxcare.1...
Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.
Summary Multiple Vulnerabilities were addressed in IBM Decision Optimization for Cloud Pak for Data version 5.3.1 before Patch 13 and 5.4.0 before Patch 6. Vulnerability Details CVEID:CVE-2026-45623 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and modify its rules by...
CLSA-2026-1790541900 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.17-tuxcare.1...
CVE-2026-100690
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...
UBUNTU-CVE-2026-100690
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...
CVE-2026-100690
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools css.PostCSS, css.TailwindCSS, js.Babel under the Node.js permission model to restrict file system reads to the project directory and configured mounts. Because the Node.js permission model validates only the lexical path and follows...
CLSA-2026-1790412857 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.19-tuxcare.1...
Security Bulletin: The Analyst Workflow App for IBM QRadar SIEM contains components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Analyst Workflow App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-73646 DESCRIPTION: PostCSS takes ...