Malicious Package

Overview create-react-app-text is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-14324 Malicious code in create-react-app-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7f200b99d8d2fadc13b72ccdd272107db79b8bc517ef5346a354479a177dff The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-77074

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...

CVE-2026-77074 n8n before 1.123.69 SSRF via Edit Image Node

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...

CVE-2026-77074 n8n before 1.123.69 SSRF via Edit Image Node

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...

CVE-2026-77074 n8n before 1.123.69 SSRF via Edit Image Node

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...

CVE-2026-77074

n8n versions before 1.123.69 contain a server-side request forgery (SSRF) vulnerability in the Edit Image node's Draw Text operation . Authenticated users can inject MVG primitives through crafted text values, enabling blind outbound HTTP requests to arbitrary addresses or access to local files. ...

CVE-2026-14163

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

CVE-2026-14163

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

CVE-2026-14163

Octopus Server's deployment variable snapshot can expose sensitive variables in clear-text under certain circumstances, leading to confidentiality impact (CVSS 7.1 HIGH, network-accessible, low privileges required). Affected component is the deployment variable snapshot; no specific version range...

EUVD-2026-63209

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text...

CVE-2026-54622: Authorization Bypass Through User-Controlled Key

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

PT-2026-78897

Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description Under certain circumstances, sensitive variables may be printed in clear-text within the deployment variable snapshot. Recommendations At the moment, there is no information about a...

EUVD-2026-62848

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-54743 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-54743

Lemmy (a fediverse link aggregator and forum) is affected by a stored XSS in lemmy-ui prior to version 0.19.19-beta.1 . The root cause lies in src/shared/markdown.ts, where mdToHtml returns a raw __html object injected by Inferno without a sanitizer pass. The [email protected] plugin,...

CVE-2026-54743 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-54743 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw html object that Inferno...

CVE-2026-68900 Wekan: Stored XSS in HTML board exports through a card-title second parse

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...

CVE-2026-18874 Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML...