4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +42 more potentially affected by CVE-2026-50557 via @angular/compiler (>=19.0.0, <=19.2.20)

@angular/compiler NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-50557 Source advisory:...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +19 more potentially affected by CVE-2026-50557 via @angular/compiler (>=21.0.0, <=21.2.14)

@angular/compiler NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =1.0.77-rc.1, =0.0.1, =0.2.0, =1.3.2 and more Source cves: CVE-2026-50557 Source advisory: OSV:GHSA-F3M7-GQXR-G87X...

@eui/deps-base (>=19.0.0-next.1, <=19.3.17), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.17) +2 more potentially affected by CVE-2026-50184 via @angular/service-worker (>=19.0.0, <=19.2.20)

@angular/service-worker NPM version =19.0.0, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.30.1 Source cves: CVE-2026-50184 Source advisory: SNYK:JS-ANGULARSERVICEWORKER-17359151...

@eui/deps-base (>=19.0.0-next.1, <=19.3.17), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.17) +2 more potentially affected by CVE-2026-50184 via @angular/service-worker (>=19.0.0, <=19.2.20)

@angular/service-worker NPM version =19.0.0, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.30.1 Source cves: CVE-2026-50184 Source advisory: OSV:GHSA-95QP-CMMW-MGQV...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +52 more potentially affected by CVE-2026-50171 via @angular/common (>=21.0.0, <=21.2.14)

@angular/common NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.4 and more Source cves: CVE-2026-50171 Source advisory: OSV:GHSA-P3VC-36G9-X9GR...

GHSA-P3VC-36G9-X9GR @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

A Denial of Service DoS vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +52 more potentially affected by CVE-2026-50171 via @angular/common (>=21.0.0, <=21.2.14)

@angular/common NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =4.0.0, =6.1.0-edge.4 and more Source cves: CVE-2026-50171 Source advisory: SNYK:JS-ANGULARCOMMON-17353316...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +41 more potentially affected by CVE-2026-52725 via @angular/core (>=19.0.0, <=19.2.20)

@angular/core NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-52725 Source advisory:...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +56 more potentially affected by CVE-2026-52725 via @angular/core (>=21.0.0, <=21.2.14)

@angular/core NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =3.0.0 - @koalarx/ui 21.2.4 and more Source cves: CVE-2026-52725 Source advisory: OSV:GHSA-692R-GRFM-V8X7...

@eui/deps-base (>=19.0.0-next.1, <=19.3.17), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.17) +2 more potentially affected by CVE-2026-50169 via @angular/service-worker (>=19.0.0, <=19.2.20)

@angular/service-worker NPM version =19.0.0, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.30.1 Source cves: CVE-2026-50169 Source advisory: SNYK:JS-ANGULARSERVICEWORKER-17359086...

@eui/deps-base (>=19.0.0-next.1, <=19.3.17), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.17) +2 more potentially affected by CVE-2026-50169 via @angular/service-worker (>=19.0.0, <=19.2.20)

@angular/service-worker NPM version =19.0.0, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.30.1 Source cves: CVE-2026-50169 Source advisory: OSV:GHSA-GV2Q-MQQV-365M...

CVE-2026-9863 Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS...

EUVD-2026-36731

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS...

GHSA-RGJC-H3X7-9MWG Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

To optimize client-side bootstrap in Server-Side Rendered SSR environments, Angular supports Hydration via provideClientHydration. During SSR, Angular serializes the application's runtime state such as cached HttpClient responses and outputs it into the HTML stream as a tag with a predictable...

kernel security update

An update is available for kernel. This update affects Rocky Linux SIG Cloud 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux...

Improper Access Control

Keycloak is vulnerable to Improper Access Control. The vulnerability is due to insufficient audience restriction enforcement in the OpenID Connect token introspection endpoint, which allows an authenticated confidential client to access sensitive token claims intended for other resource servers...

redis: use-after-free in unblock client flow may allow remote code execution

A flaw was found in Redis. The unblock client flow does not handle an error return from the processCommandAndResetClient when re-executing a blocked command. If a blocked client is evicted during this flow, an authenticated attacker can cause a use-after-free issue. This potentially leads to...

CVE-2026-45416

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS Transport Layer Security ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service DoS due to excessive memor...

CVE-2026-9278

The Form Builder CP WordPress plugin before 1.2.47 does not properly sanitize a form configuration value before storing it and using it as part of a client-side script execution, allowing authenticated users with Editor-level access and above to perform Stored Cross-Site Scripting attacks against...

CVE-2026-9278 Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure

The Form Builder CP WordPress plugin before 1.2.47 does not properly sanitize a form configuration value before storing it and using it as part of a client-side script execution, allowing authenticated users with Editor-level access and above to perform Stored Cross-Site Scripting attacks against...