PT-2026-83603

TuxCare rebuilt bootstrap to address 7 CVEs. Fixed in 3.3.5-tuxcare.1...

CVE-2026-61807

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...

CVE-2026-61807

Snipe-IT versions before 8.6.2 are vulnerable to stored DOM XSS: a crafted manufacturer/supplier name flows into data-selected-count-id in bootstrap-table.blade.php, is decoded client-side, and is injected via jQuery .after(), executing JS in authenticated users' sessions. Fix is version 8.6.2. N...

CVE-2026-61807 Snipe-IT: Stored DOM XSS via table selected-count IDs

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...

CVE-2026-61807: Improper Neutralization of Input During Web Page Generation

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in resources/views/partials/bootstrap-table.blade.php. Client-side code reads the browser-decoded countId, uses it as a...

xspawn macOS launchd Parent Spoofing Client

xspawn is a macOS process execution utility that submits programs directly to launchd through its private XPC bootstrap interface. Rather than executing the requested program itself, xspawn causes launchd to spawn the process through xpcproxy, resulting in Endpoint Security and EDR telemetry...

Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-2055)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2055 advisory. Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of...

PT-2026-123547

Rebuild without bootstrap binaries self-hosted with the 1.90.0 built by the bootstrap pass...

Important: javapackages-bootstrap

Issue Overview: Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of heade...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-73634 via org.apache.struts:struts2-core (>=6.0.0, <=6.10.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-73634 Source advisory: SNYK:JAVA-OR...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.1.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-73634 via org.apache.struts:struts2-core (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.2.1 and more Source cves: CVE-2026-73634 Source advisory:...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (>=6.0.0, <=6.1.0) +4 more potentially affected by CVE-2026-73631 via org.apache.struts:struts2-json-plugin (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-json-plugin MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =7.0.0, =7.0.0, =7.2.1 Source cves: CVE-2026-73631 Source advisory: SNYK:JAVA-ORGAPACHESTRUTS-19350821...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (6.1.0), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (6.1.0) +3 more potentially affected by CVE-2026-73632 via org.apache.struts:struts2-json-plugin (7.2.1)

org.apache.struts:struts2-json-plugin MAVEN version 7.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.struts:struts2-json-plugin and may be impacted: - com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase 6.1.0 -...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-73635 via org.apache.struts:struts2-core (>=6.0.0, <=6.10.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-73635 Source advisory: MEND:CVE-202...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.1.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-73635 via org.apache.struts:struts2-core (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.2.1 and more Source cves: CVE-2026-73635 Source advisory: MEND:CVE-2026-73635...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.1.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-73634 via org.apache.struts:struts2-core (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.2.1 and more Source cves: CVE-2026-73634 Source advisory: MEND:CVE-2026-73634...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (>=6.0.0, <=6.1.0) +4 more potentially affected by CVE-2026-73633 via org.apache.struts:struts2-json-plugin (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-json-plugin MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =7.0.0, =7.0.0, =7.2.1 Source cves: CVE-2026-73633 Source advisory: SNYK:JAVA-ORGAPACHESTRUTS-19352508...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=6.0.0, <=6.1.0), com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0) +55 more potentially affected by CVE-2026-73633 via org.apache.struts:struts2-core (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-core MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0, =7.0.0, =7.0.0, =7.0.0, =7.2.1 and more Source cves: CVE-2026-73633 Source advisory:...

Malicious code in bootstrap-custom-ui (npm)

Source: amazon-inspector 652b61501946d7df441ba0b302898ff5aa223b09828775504099fc8d91878d81 The package presents itself as a React/Bootstrap UI component library but its default export getPlugin performs an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/108 and...

Malicious code in bootstrap-custom-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b61501946d7df441ba0b302898ff5aa223b09828775504099fc8d91878d81 The package presents itself as a React/Bootstrap UI component library but its default export getPlugin performs an HTTPS request to the hardcoded...