homeassistant-stubs (2022.9.2), mqtt-hass-base (4.0.8) +1 more potentially affected by CVE-2026-91129 via homeassistant (2022.9.2)

homeassistant PYPI version 2022.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.9.2 - mqtt-hass-base 4.0.8 - pytest-homeassistant-custom-component 0.11.21 Source cves: CVE-2026-91129...

homeassistant-stubs (2023.8.2), pytest-homeassistant-custom-component (0.13.51) potentially affected by CVE-2026-91129 via homeassistant (2023.8.2)

homeassistant PYPI version 2023.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.8.2 - pytest-homeassistant-custom-component 0.13.51 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.3.0b0), pytest-homeassistant-custom-component (0.6.16) potentially affected by CVE-2026-91129 via homeassistant (2022.3.0b0)

homeassistant PYPI version 2022.3.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.3.0b0 - pytest-homeassistant-custom-component 0.6.16 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2023.3.3), pytest-homeassistant-custom-component (0.13.7) potentially affected by CVE-2026-91129 via homeassistant (2023.3.3)

homeassistant PYPI version 2023.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.3.3 - pytest-homeassistant-custom-component 0.13.7 Source cves: CVE-2026-91129 Source advisory:...

CVE-2026-93383

A flaw was found in Google Chrome. This vulnerability, an information leak in the Permissions component, allows a remote attacker to leak cross-origin data. Exploitation occurs when a user visits a specially crafted HTML page, leading to unauthorized disclosure of sensitive information...

CVE-2026-76709

A vulnerability exists in the internal administrative component of the HPE Networking Analytics and Location Engine (ALE) . This flaw allows an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges . Successful exploitation could lead to a f...

CVE-2026-93375

A flaw was found in Google Chrome. This vulnerability, located in the Tracing component, involves incorrect reference resolution. A local attacker could exploit this flaw by using a local program, potentially leading to arbitrary code execution outside the browser's security sandbox...

@apolitical/component-library (>=8.3.5-ac.0, <=8.3.18-beta.0), @novu/nextjs (>=2.5.0, <=3.17.1-rc.1-rc.da35e9062d) +2 more potentially affected by CVE-2026-75510 via @novu/js (>=2.6.3, <=3.17.1-rc.1-rc.da35e9062d)

@novu/js NPM version =2.6.3, =8.3.5-ac.0, =2.5.0, =2.0.0-alpha.0, =2.2.0-rc.2, =3.17.1-rc.1-rc.da35e9062d Source cves: CVE-2026-75510 Source advisory: MEND:CVE-2026-75510...

PT-2026-96328

Name of the Vulnerable Software and Affected Versions Yonyou U8cloud versions 5.x Description A SQL injection issue exists within the OpenAPI component. A remote attacker can exploit this by manipulating the operator argument in the '/u8cloud/openapi/so.saleorder.sendaudit' endpoint. SQL injectio...

PT-2026-96788

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 @novu/js versions prior to 3.18.0 @novu/react Inbox component versions prior to 3.18.0 Description Novu's In-App Inbox and the @novu/react Inbox component fail to validate the URL scheme of notification...

vm2 Library VM Component Data Compromise

The vulnerability of the new VM component in the vm2 library of the NPM package manager is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

EUVD-2026-84181

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action...

firefox: thunderbird: Use-after-free in the XML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XML component...

firefox: thunderbird: Use-after-free in the SVG component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the SVG component...

firefox: thunderbird: Use-after-free in the XML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XML component...

firefox: thunderbird: Use-after-free in the Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Networking component...

CVE-2026-84140

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the DOM: Navigation component Mitigation Update to Firefox ESR 153.2, Firefox ESR 140.15, or Firefox 155 or later. Red Hat will provide updated Firefox...

CVE-2026-84139

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue in the DOM: Events component...

CVE-2026-84129

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the DOM: Navigation component...

CVE-2026-79320

Stencil core 4.43.5 contains a DOM-based cross-site scripting XSS vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes t...