PT-2026-56539

Name of the Vulnerable Software and Affected Versions PasswordPusher versions prior to 2.8.1 Description Insufficient validation in the valid url function allows the application to accept data URI schemes in URL push payloads. This enables attackers to create malicious pushes containing...

PT-2026-56340

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An issue occurs when the application opens a PDF and JavaScript performs operations on the page and document. This causes page-related objects to lose synchronization, while t...

CVE-2026-59876: Improperly Controlled Modification of Object Prototype Attributes

protobufjs compiles protobuf definitions into JavaScript JS functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key proto to change the prototype of the returned map object instead of...

CVE-2026-59869: Inefficient Algorithmic Complexity

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

PT-2026-56497

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.6.5 protobufjs versions prior to 8.6.6 Description protobufjs compiles protobuf definitions into JavaScript functions. The software parses option names by advancing through schema tokens until an = token is reach...

PT-2026-56339

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A crash occurs when the application opens a PDF file and JavaScript deletes PDF fields. The subsequent logic continues to use old field pointers, leading to...

nodejs:22 security, bug fix, and enhancement update

nodejs 1:22.23.1-1 - Update to version 22.23.1 Resolves: RHEL-186622 RHEL-185998 RHEL-183669 Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338...

PT-2026-56330

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Embedded JavaScript within a PDF can delete pages, rendering the object invalid. The application crashes when it attempts a write operation on these invalid pop-...

CVE-2026-58191: Improper Neutralization of Input During Web Page Generation

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner routes, and compileLodashTemplate...

Fedora 43 : perl-JavaScript-Minifier-XS (2026-629b796808)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-629b796808 advisory. 0.16 bump - Fix CVE-2026-56017 and CVE-2026-56018 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora 44 : perl-JavaScript-Minifier-XS (2026-634b594205)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-634b594205 advisory. 0.16 bump - Fix CVE-2026-56017 and CVE-2026-56018 Tenable has extracted the preceding description block directly from the Fedora security advisory...

CVE-2026-36163

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file...

CVE-2026-55592

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

NPM: Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

NPM: Better Auth has stored XSS in the auth-server origin via javascript: redirecturi in oidc-provider and mcp vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.13...

Open Redirect

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Open Redirect via the redirectURI value returned from the consent response in the authorization flow. An attacker can execute arbitrary JavaScript in the...

GHSA-86J7-9J95-VPQJ Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the oidc-provider plugin or the mcp plugin from better-auth/plugins. The mcp plugin wraps the same provider and carries the same defect. Both are on the migration path to...

Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp

Am I affected? Check each condition. Users are affected when all of the first three hold. - Their application enables the oidc-provider plugin or the mcp plugin from better-auth/plugins. The mcp plugin wraps the same provider and carries the same defect. Both are on the migration path to...

CVE-2026-55592 Dashy: XSS in workspace url parameter

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

CVE-2026-55592

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...

EUVD-2026-42103

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript: URL, JavaScript runs on the Dashy...