7764 matches found
[SECURITY] [DSA 6545-1] roundcube security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6545-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 06, 2026 https://www.debian.org/security/faq -...
CVE-2026-105784
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...
PT-2026-106942
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue in the CSS component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use after...
CVE-2026-105784: Improper Neutralization of Input During Web Page Generation
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...
CVE-2026-106269: Use After Free
Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...
CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...
EUVD-2026-92871
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...
CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...
CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in...
CVE-2026-105784
The open-source note-taking application Joplin is vulnerable to CSS injection in versions prior to 3.7.13 . The root cause is the improper handling of jsoncanvas fences, where the TextNode.tsx and FileNode.tsx components render card content using the full Markdown renderer and insert the resultin...
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Impact . and are not word delimiters in the tokenizer, so a flat selector such as .a.a.a... reaches splitWord as a single word token carrying n class or id indexes. Three passes scanned those index arrays linearly for every index, making the parse On^2 in the number of indexes rather than in inpu...
GHSA-RJ75-HQRM-R3GF PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Impact . and are not word delimiters in the tokenizer, so a flat selector such as .a.a.a... reaches splitWord as a single word token carrying n class or id indexes. Three passes scanned those index arrays linearly for every index, making the parse On^2 in the number of indexes rather than in inpu...
CVE-2026-100815
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the CSS Parsing and Computation component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securi...
Malicious code in css-nrmgzn-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami...
MAL-2026-17576 Malicious code in css-nrmgzn-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami...
MAL-2026-17573 Malicious code in css-eqxcdx-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a93fe0298f7671177e324947b2bf89ec3729b203621f7ca67aa8cd10439306a2 The package presents itself as a polyfill exporting Wix thunderbolt-style registry stubs thunderboltRegistry, siteAssetsRegistry,...
Malicious code in css-eqxcdx-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a93fe0298f7671177e324947b2bf89ec3729b203621f7ca67aa8cd10439306a2 The package presents itself as a polyfill exporting Wix thunderbolt-style registry stubs thunderboltRegistry, siteAssetsRegistry,...
Malicious code in css-kfvwax-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2041e61cd16558aaaeac8a2f26024866a6b949d93817f78de744c5c1781023df On require, thunderboltRegistry.js runs an IIFE that shells out via childprocess to collect host identity id, whoami, uname -a, network interface...
MAL-2026-17575 Malicious code in css-kfvwax-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2041e61cd16558aaaeac8a2f26024866a6b949d93817f78de744c5c1781023df On require, thunderboltRegistry.js runs an IIFE that shells out via childprocess to collect host identity id, whoami, uname -a, network interface...
MAL-2026-17574 Malicious code in css-gwqyid-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19 thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance id, whoami, full process environment via env, and ifconfig/i...