CVE-2026-47219

CVE-2026-47219 : The vulnerability affects the find-my-way HTTP router. Versions before 9.7.0 are susceptible to remotely triggerable DoS when used with Node's HTTP/2 server. The issue arises because lookup() passes req.method to find(), and find() indexes this.trees[method]. Since this.trees is ...

CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

CVE-2026-53666

CVE-2026-53666 affects React Router versions 6.4.0 through 7.17.0 where attacker-supplied input could overwrite parts of errors captured during SSR, enabling arbitrary constructor execution on the client and triggering outbound network requests. This requires specific, unlikely application-layer ...

CVE-2026-53666 React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

CVE-2026-53666 React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

EUVD-2026-49628

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

GHSA-337J-9HXR-RHXG React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

If application code allows attacker supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for attacker to trigger unexpected constructor execution on the client which would trigger outbound network traffic. This is only possible with very specific a...

NPM: React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

NPM: React Router: Arbitrary Constructor Injection via deserializeErrors in React Router SSR Hydration vulnerability discovered by ? in WordPress Npm react-router versions = 6.4.0, 7.18.0...

CVE-2026-1771

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible...

EUVD-2026-46168

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

CVE-2026-45067

Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...

CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals records an...

MAL-2026-10414 Malicious code in express-request-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30 The package's main entry index.js presents itself as a normalize-path utility but on module load calls initPlugin at top level, which performs an HTT...

MAL-2026-10182 Malicious code in express-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c911dfdf99f0c6e13cb9e55883a5c2e17cca0b78d3149e38c0cafb6320ea742 The package advertises itself as Express security middleware XSS/SQLi protection, input sanitization but the middleware returned to Express is a no-o...

MAL-2026-10153 Malicious code in notifier-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4c2346bef8105dc24079ee47eb8cd65dbb92f7dbbd6d17ac0c576646878298c The package presents itself as a pino-compatible logger main entry exports a middleware aliased as pino, and lib/ contains pino-shaped files such as...

MAL-2026-10137 Malicious code in type-elint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f29d6bfc122cb5792d95cfade56e62789f83366b30fc0d58a88a84113d89962c Package impersonates the pino logger README is pino documentation, package name is a lookalike. The main export is a middleware factory that spawns...

Malicious code in type-elint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f29d6bfc122cb5792d95cfade56e62789f83366b30fc0d58a88a84113d89962c Package impersonates the pino logger README is pino documentation, package name is a lookalike. The main export is a middleware factory that spawns...