JLSEC-2026-1138 Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer...

Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is define...

CVE-2026-66296

Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...

CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream

A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the compiler's i18n metadata collection path, which lets event-handler attributes be marked translatable with i18n-on such as i18n-onerror, bypassing the validation that normally blocks binding to event-handl...

GHSA-VPX6-8PJR-4G3V Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

A Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing the content of fallback raw-content elements , , , and . When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engi...

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

A Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing the content of fallback raw-content elements , , , and . When rendering dynamic text content inside fallback raw-content elements via template bindings, the template engi...

CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-69149

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

EUVD-2026-52350

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-69149

CVE-2026-69149 affects Angular SSR: a Cross-Site Scripting (XSS) vulnerability in the DOM emulation dependency (domino) used by @angular/platform-server when serializing fallback raw-content elements (, , , ). The issue exists prior to versions 20.3.27, 21.2.19, and 22.0.7 and is fixed in those r...

CVE-2026-67317

A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to...

CVE-2026-68586

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc. While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints gated only by...

CVE-2026-68584

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

CVE-2026-69091

Admidio before 5.0.11 has an authentication bypass in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only state, allowing unauthenticated attackers to read forum topics and posts by directly accessing the module with ...

CVE-2026-69083 SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...

CVE-2026-69083

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...

CVE-2026-69083

CVE-2026-69083 affects SiYuan versions before 3.7.3. The issue is a SQL injection in the fullTextSearchAssetContent endpoint, reachable by unauthenticated users, with published RoleReader tokens. The root cause is unescaped method parameters and REGEXP clauses that allow an attacker to run arbitr...