Malicious Package

Overview vite-svg-parse is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-internal-svg-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in node-internal-svg-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea179fb3670844db867458418a68b3eb69dfd983ebe1fe96b2a4b41601266fc4 Package advertises itself as an SVG loader using well-known CDN providers, but exported functions getPlugin, setPlugin, and getPluginExten build a...

MAL-2026-13766 Malicious code in node-internal-svg-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea179fb3670844db867458418a68b3eb69dfd983ebe1fe96b2a4b41601266fc4 Package advertises itself as an SVG loader using well-known CDN providers, but exported functions getPlugin, setPlugin, and getPluginExten build a...

OPENSUSE-SU-2026:21553-1 Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issue: - CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing specially crafted SVG files bsc1268878...

CVE-2026-72594

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

CVE-2026-72583

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

CVE-2026-72576

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...

CVE-2026-72594 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

CVE-2026-72594 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

CVE-2026-72583

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

CVE-2026-72583 fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

CVE-2026-72583

CVE-2026-72583 affects fastschema up to v0.15.1. A stored XSS exists when uploading SVGs due to a MIME type bypass: the PutMultipart path validates the Content-Type header instead of inspecting file content, enabling an attacker (low-privileged, authenticated) to rename files to .jpg while declar...

CVE-2026-72583 fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

EUVD-2026-55223

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

EUVD-2026-55230

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...

CVE-2026-72576

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...

CVE-2026-72576

CVE-2026-72576 : Bludit 4.0.0-beta contains a stored XSS vulnerability exploitable by a low-privileged authenticated user (Author) who uploads a crafted SVG as the site logo. The flaw resides in the /admin/ajax/logo-upload.php path, which moves the uploaded file directly to the web root via Files...

CVE-2026-72576 Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...

CVE-2026-72576 Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...