@alexaegis/svelte-config (>=0.9.2, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=2.1.0) +19 more potentially affected by CVE-2026-66062 via @sveltejs/kit (>=2.0.0, <=2.70.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.137, =0.0.0-52469075, =39.2.3, =10.0.1, =0.1.0, =0.0.1-alpha.26, =2.0.0, =0.4.1, =5.0.0-alpha.1, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-66062 Source advisory: SNYK:JS-SVELTEJSKIT-18592743...

@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +13 more potentially affected by CVE-2026-72744 via @nuxt/nitro-server (>=4.4.7, <=4.5.0)

@nuxt/nitro-server NPM version =4.4.7, =3.2.0, =4.5.0-depup.0, =1.13.12, =1.6.0-rc.3, =1.0.0-alpha.17, =1.0.0, =4.4.7, =0.6.0-rc.4, =0.2.3, =1.0.0-alpha.12, =1.0.0-alpha.20 Source cves: CVE-2026-72744 Source advisory: SNYK:JS-NUXTNITROSERVER-18593816...

@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +11 more potentially affected by CVE-2026-72744 via nuxt (>=4.4.7, <=4.5.0)

nuxt NPM version =4.4.7, =3.2.0, =1.13.12, =1.6.0-rc.3, =1.0.0-alpha.17, =1.0.0, =0.6.0-rc.4, =0.2.3, =1.0.0-alpha.12, =1.0.0-alpha.20 Source cves: CVE-2026-72744 Source advisory: OSV:GHSA-7C4V-FWGW-9RF7...

kernel: ipc: limit next_id allocation to the valid ID range

A flaw was found in the Linux kernel. The ipcidralloc function, used in the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a...

CVE-2026-66491

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

CVE-2026-66493

CVE-2026-66493 affects the Joomla extension Phoca Commander (phoca.cz) versions 1.0.0 through 6.1.3. The issue is a path traversal vulnerability caused by improper limitation of paths for delete, copy, and move actions. The CVSS data indicates NETWORK access with low complexity and high privilege...

CVE-2026-12801

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

EUVD-2026-54365

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-12801

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

EUVD-2026-54281

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llamabatchinit function where unchecked multiplications in malloc calls can wrap past INT32MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causin...

RHEL 9 : kernel (RHSA-2026:51603)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51603 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: KVM: x86: Don't recheck L1...

GHSA-8HCV-X26H-MCGP node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

Description WrappedRE2::Replace builds the replacement result and hands it to V8 with .ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the string/buffer exceeds its maximum length: lib/replace.cc v1.24.1: cpp // L553 — Buffer return path...

NPM: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

NPM: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 vulnerability discovered by ? in WordPress Npm ngx-extended-pdf-viewer versions = 27.0.0-rc.0, 29.0.0-rc.3...

@0xwork/connect (0.1.8), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1446 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.1.8-fix.3, =1.0.0, =0.2.0, =0.0.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.104.0, =0.1.0, =0.2.340, =0.1.0, =0.17.9, =0.22.4 and more Source cves: CVE-2026-16633 Source advisory: SNYK:JS-PDFJSDIST-18592344...

CVE-2026-71488 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +21416 more potentially affected by unknown CVE via js-yaml (>=3.0.0, <=3.15.0)

js-yaml NPM version =3.0.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5P4M-2WFM-XMQJ...

@nx/powerpack-azure-cache (>=5.0.0, <=5.0.7) potentially affected by CVE-2026-71476 via @nx/azure-cache (>=5.0.0, <=5.0.7)

@nx/azure-cache NPM version =5.0.0, =5.0.0, =5.0.7 Source cves: CVE-2026-71476 Source advisory: OSV:GHSA-VP3H-GHGH-JR7G...

EUVD-2026-54241

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid...

CVE-2026-66843

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...

CVE-2026-43631

The CVE affects llama.cpp builds from b7492 to b9060, where a use-after-free in the vocab pointer of llama-server occurs when --sleep-idle-seconds is enabled. Unauthenticated remote attackers can trigger this by sending requests to affected endpoints as the server transitions to sleep mode, causi...