Malicious code in apex-frontend-bootstrap-dynamo (npm)

Source: amazon-inspector 52b33ef97cc7198d0ccc014aa6a18a7cb7f156edffa6ce990a9bc80488bf5e17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antd-hydra-ganymede-bootstrap (npm)

Source: amazon-inspector 578271e4a2842f9d3d7fc522390747a7f8ce630f19adc23dd9b8da8e7bfe041c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in altair-rollup-bootstrap-webdriver-manager (npm)

Source: amazon-inspector cf705e24bcc766ffd8b06f92a877be746751610972bad74059d45440502aab2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Security Bulletin: Due to use of bootstrap, IBM License Key Server Administration and Reporting Tool is affected by Cross-site scripting

Summary IBM License Key Server Administration and Reporting Tool uses bootstrap javascript library internally. Vulnerability Details CVEID:CVE-2025-1647 DESCRIPTION: Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Bootstrap allows...

CVE-2026-84840: Missing Authentication for Critical Function

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly availabl...

PT-2026-84851

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly availabl...

Malicious code in aldebaran-bootstrap-mensa-graphql (npm)

Source: amazon-inspector c009c71f1315940d59a9b82670ee814e68fd91ab6279feadee976b4cc23c5e6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in adonis-bootstrap-mantle-loop (npm)

The package adonis-bootstrap-mantle-loop was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-81731

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...

EUVD-2026-67236

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...

CVE-2026-81731 Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...

CLSA-2026-1787226168 TuxCare security update for bootstrap (7 CVEs)

TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.5-tuxcare.1...

CLSA-2026-1787224853 TuxCare security update for bootstrap (7 CVEs)

TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.1-tuxcare.1...

CLSA-2026-1787224839 TuxCare security update for bootstrap (7 CVEs)

TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.2-tuxcare.1...

CLSA-2026-1787224704 TuxCare security update for bootstrap (5 CVEs)

TuxCare rebuilt bootstrap to address 5 CVEs. Fixed in 3.0.0-tuxcare.1...

PT-2026-83600

TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.2-tuxcare.1...

PT-2026-83601

TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.1-tuxcare.1...

PT-2026-83599

TuxCare rebuilt bootstrap to address 8 CVEs. Fixed in 3.0.0-tuxcare.1...

PT-2026-83603

TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.5-tuxcare.1...

CVE-2026-61807

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...