CVE-2026-32887 Effect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using RpcServer.toWebHandler or HttpApp.toWebHandlerRuntime inside a Next.js App Router route handler, any Node.js AsyncLocalStorage-dependent...

CVE-2026-32887

The Connected document details a concurrency vulnerability in the Effect ecosystem where AsyncLocalStorage (ALS) context is not properly propagated across fibers in a web handler under concurrent load. Root cause: a scheduler drains multiple fiber continuations in a single drain cycle, causing AL...

CVE-2026-32887 Effect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using RpcServer.toWebHandler or HttpApp.toWebHandlerRuntime inside a Next.js App Router route handler, any Node.js AsyncLocalStorage-dependent...

CVE-2026-33156

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32...

CVE-2026-31874

creationtimestamp| type| source ---|---|--- 2026-03-20 17:00:13+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhiyj72xjw22...

CVE-2026-31381

creationtimestamp| type| source ---|---|--- 2026-03-20 13:07:52+00:00| seen| https://bsky.app/profile/rapid7.com/post/3mhiljo6zek2g 2026-03-20 16:01:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhivaleean2u 2026-03-20 21:33:07+00:00| seen|...

Security Bulletin: IBM App Connect for Manufacturing is vulnerable to Improper Validation of Certificate with Host Mismatch due to Apache Log4j Core (CVE-2025-68161)

Summary IBM App Connect for Manufacturing is vulnerable to Improper Validation of Certificate with Host Mismatch due to Apache Log4j Core Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostnam...

SUSE CVE-2025-46299

A memory initialization issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. Processing maliciously crafted web content may disclose internal states of the app...

CVE-2026-4472

creationtimestamp| type| source ---|---|--- 2026-03-20 06:23:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhhuxi42ca2x...

PT-2026-26681

Name of the Vulnerable Software and Affected Versions Effect versions prior to 3.20.0 @effect/rpc versions prior to 0.72.1 @effect/platform versions prior to 0.94.2 Description Effect is a TypeScript framework used for building TypeScript applications. A flaw exists in versions prior to 3.20.0,...

NLTK 跨站脚本漏洞

NLTK is an open-source natural language toolkit developed by NLTK. It is used to support research and development in natural language processing. Versions of NLTK 3.9.3 and earlier had a cross-site scripting vulnerability. This vulnerability stemmed from the lookup... route in nltk.app.wordnetapp...

CVE-2026-0957

creationtimestamp| type| source ---|---|--- 2026-03-19 23:40:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhh6fexe6b2h...

CVE-2026-32751

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree MobileFiles.ts renders notebook names via innerHTML without HTML escaping when processing renamenotebook WebSocket events. The desktop version Files.ts properly uses escapeHtml for the same...

CVE-2026-26139

creationtimestamp| type| source ---|---|--- 2026-03-19 21:34:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgxdwg6nj2u...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-27738 +1 more via @angular/ssr (>=21.1.2, <=21.2.0)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-27738, CVE-2026-33397 Source advisory: SNYK:JS-ANGULARSSR-15701178...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-33397 via @angular/ssr (>=21.1.2, <=21.2.0)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-33397 Source advisory: OSV:GHSA-VFX2-HV2G-XJ5F...

CVE-2026-32751 SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree MobileFiles.ts renders notebook names via innerHTML without HTML escaping when processing renamenotebook WebSocket events. The desktop version Files.ts properly uses escapeHtml for the same...

CVE-2026-32751 SiYuan Vulnerable to Remote Code Execution via Stored XSS in Notebook Name - Mobile Interface

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree MobileFiles.ts renders notebook names via innerHTML without HTML escaping when processing renamenotebook WebSocket events. The desktop version Files.ts properly uses escapeHtml for the same...

CVE-2026-32751

SiYuan vulnerability CVE-2026-32751 affects versions 3.6.0 and earlier where the mobile file tree (MobileFiles.ts) renders notebook names with innerHTML without escaping during renamenotebook WebSocket events. This allows an authenticated user who can rename notebooks to inject HTML/JavaScript th...

CVE-2026-32728

creationtimestamp| type| source ---|---|--- 2026-03-19 21:01:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgvj7xwc425 2026-03-19 21:13:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhgw6rdod52h...