Cross-site Scripting (XSS)

Overview github.com/prometheus/prometheus/web/ui is a systems and service monitoring system Affected versions of this package are vulnerable to Cross-site Scripting XSS via various UI components whose innerHTML is rendered unsanitized, based on user input. The metric names and label values used b...

Malicious Package

Overview @pes-ui/components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2591 Malicious code in @pes-ui/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c86f728ffc679c2767dd34f810c998e9e7fa49098d757ee8a3ba6b050f1754f The package @pes-ui/components was found to contain malicious code. Source: ghsa-malware...

Malicious code in @pes-ui/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c86f728ffc679c2767dd34f810c998e9e7fa49098d757ee8a3ba6b050f1754f The package @pes-ui/components was found to contain malicious code. Source: ghsa-malware...

Denial Of Service

React Server Components is vulnerable to Denial of Service. The vulnerability is due to specially crafted HTTP requests to Server Function endpoints, where the payload of the HTTP request causes excessive CPU usage for up to a minute ending in a thrown error that is catchable...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — React Server Components RCE | CTF Writeup...

The vulnerability of Google Chrome’s PWA components allows attackers to install any PWA applications they desire.

The vulnerability of Google Chrome’s PWA components is related to access control errors. Exploiting this vulnerability allows a remote attacker to install arbitrary PWA applications...

[SECURITY] [DSA 6206-1] gdk-pixbuf security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6206-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 11, 2026 https://www.debian.org/security/faq -...

OESA-2026-1895 gdk-pixbuf2 security update

gdk is written in C but has been designed from the ground up to support a wide range of languages. It provide a complete set of widgets,and suitable for projects ranging from small one-off tools to complete application suites. Security Fixes: A flaw was found in the gdk-pixbuf library. This...

Exploit for CVE-2026-23869

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-o...

Exploit for CVE-2026-23869

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-o...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, aws-privateca-issuer, sftpgo-plugin-eventsearch, osv-scanner, goreleaser, tailscale, flux-image-automation-controller, github-mcp-server, ingress-nginx-controller, flux-image-reflector-controller, dgraph, malcontent, newrelic-infra-operator,...

GHSA-M4PR-4J3G-9V7V vulnerabilities

Vulnerabilities for packages: tetragon, gatus, redis-operator, newrelic-nri-statsd, cerbos, cri-tools, neuvector-dbgen, kafka-proxy, git-lfs, terraform-provider-random, minio-operator, clickhouse-operator, pguser, act, direnv, kyverno, fluxcd-kustomize-mutating-webhook, cue, hugo,...

CVE-2026-27140 vulnerabilities

Vulnerabilities for packages: tetragon, gatus, nats-server-config-reloader, redis-operator, newrelic-nri-statsd, cerbos, cri-tools, neuvector-dbgen, kafka-proxy, git-lfs, terraform-provider-random, minio-operator, clickhouse-operator, cargobump, pguser, shfmt, act, direnv, mockgen, kyverno,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: tetragon, gatus, redis-operator, newrelic-nri-statsd, cerbos, cri-tools, neuvector-dbgen, kafka-proxy, git-lfs, terraform-provider-random, minio-operator, clickhouse-operator, pguser, act, direnv, kyverno, fluxcd-kustomize-mutating-webhook, cue, hugo,...

GHSA-M4PR-4J3G-9V7V vulnerabilities

Vulnerabilities for packages: aws-eks-pod-identity-agent, flagger, gitlab-operator-fips, nri-haproxy-fips, grpcurl, minio-object-browser, crossplane-provider-aws-servicediscovery-fips, hugo, configmap-reload, livekit-egress, crossplane-provider-sql, kcp, prometheus-beat-exporter, tigera-operator,...

GHSA-V457-WXVJ-P9W9 @vitejs/plugin-rsc has a Denial of Service with React Server Components

Impact @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.4. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg Patches Upgrade immediately to @vitejs/[email protected] or...

@vitejs/plugin-rsc has a Denial of Service with React Server Components

Impact @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.4. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg Patches Upgrade immediately to @vitejs/[email protected] or...

Next.js has a Denial of Service with Server Components

A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as CVE-2026-23869. You can read more about this advisory our this...