ROS-20260914-73-0112

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

PT-2026-91260

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may...

PT-2026-91293

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

PT-2026-91061

Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted extension configuration from event code...

CVE-2026-91021: Improper Neutralization of Input During Web Page Generation

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting XSS vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled webViewSrc values. This vulnerability allows attackers with note-authoring privileges to inject arbitrary...

CVE-2026-91146: Improper Neutralization of Input During Web Page Generation

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

PT-2026-91744

Name of the Vulnerable Software and Affected Versions Takahe versions prior to 0.11.1 Description The software fails to restrict URL schemes in link hrefs within federated post content and profile summaries. This allows remote actors to inject javascript: links. When clicked, these malicious link...

ROS-20260914-73-0027

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

Malicious code in jekyll-javascript-draco-nebula (npm)

Source: amazon-inspector 1d6d1b5e23f5b42bd7a38be0d7cee36fdd4171be8cdb7f30aaa02cf2da7e5680 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-procyon-nconf-odin (npm)

Source: amazon-inspector ddb8ed7e951c9b0f86612e0b9e2242fcd5a8ecb02d367f9d376cd3d3dfeada6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-pipe-docusaurus-nodemon (npm)

Source: amazon-inspector fe24f071b8345b4565c3d327bb46b81da8836d9ef89d16fe70049e65458960e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-nodejs-lint-staged-build (npm)

Source: amazon-inspector 950a7016236c5fc899c18a2afba5edad822d00009aafafb79a9a52e55dd8a106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-indus-ceres-ophiuchus (npm)

Source: amazon-inspector 183d484945bde92944532e2b9af5c200b70e70bcd5879553d78a8deb2da8f18e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-astrochemistry-panspermia-mongoose (npm)

The package javascript-astrochemistry-panspermia-mongoose was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in javascript-await-upgrade-venus (npm)

Source: amazon-inspector 14592802e63f3973ef3ffea2ec15e4d1dd4b08a23406db7faf7b24ee39c3e473 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-yonder-mdx-cypress (npm)

Source: amazon-inspector 1a05bd12471c26111582fb880b7b86a83151e218c40d900842b30e9e5b6c8b84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-protoplanetarydisk-yakutsk-string (npm)

The package javascript-protoplanetarydisk-yakutsk-string was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in javascript-postcss-loader-fornax-ariel (npm)

Source: amazon-inspector 09a46307816ef7e2a4a5c766bce7438cb607b945a2cd4692da71b738b8332511 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-nconf-ursa-promise (npm)

Source: amazon-inspector ec6c388d4d528181105b95e70ffbfcdb98a70dc29eecadcf4e7ffbd9fc7966bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-websockets-neptune-janus (npm)

Source: amazon-inspector a40c1fc54cb251468d40fb099bef3a0d38a64ef7923792843c8cd11d5e3554c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...