Update Chrome now to protect against an actively exploited vulnerability

Chrome is rolling out an update for its desktop browser. The update includes 230 security fixes, one of which is known to be actively exploited. The stable channel has been updated to 153.0.8010.36/.37 for Windows and Mac, and 153.0.8010.36 for Linux. How to update Chrome If you don’t want to wai...

Malicious code in extraction-test-javascript-utilities (npm)

The package extraction-test-javascript-utilities was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in express-superagent-javascript-hapi (npm)

Source: amazon-inspector d9b794550053245b66618b7061c10440b97b535bc4dad030d638689510877234 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eslint-plugin-nightwatch-javascript-restart (npm)

Source: amazon-inspector b333ff43ee1f9be398cf888d133ef6f16c4abeb587460d88c4ae7d5a8173469d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eslint-config-morgan-javascript-umbra (npm)

Source: amazon-inspector 667105714c7d9e1c524299dfa33797fcde0a423352f5c86fc8b866f4bcc72edf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in envconfig-dotenv-safe-middleware-javascript (npm)

Source: amazon-inspector 2bb6d3787cd8e826342e1a35672bcd802bf1f5e183672c196cde0b5b219fdc13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eleventy-sails-inquirer-javascript (npm)

Source: amazon-inspector a8f749a1a37d1634292491cb74be61f5db279766a342da292ba9dd32fabf4394 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in elektra-webdriver-mocha-xanadu-javascript (npm)

Source: amazon-inspector a4dc7b351cfdfe332b731cfc5e306c28d94acf928ec0d493c81b06328d944a8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in electron-rimraf-orbit-javascript (npm)

Source: amazon-inspector 63c15934b6b4fae85cb44345d59753dd5908f9bf7fcd935dc64749584d11eada This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

SummaryProwler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

PYSEC-2026-3864 Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

Material for MkDocs: DOM XSS in search suggestions via query parameter

ImpactMaterial for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. PatchesThe issue is fixed in Material for...

plone.app.portlets vulnerable to denial of service via RSS feed portlet

ImpactBy adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers SSRF. A malicious...

CVE-2026-0308 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

CVE-2026-0308

This CVE entry is reserved with no public technical details yet. The affected product, root cause, and impact are not specified in the provided documents. Monitor for updates as details are expected once the vulnerability is publicly announced.

EUVD-2026-75256

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama...

CVE-2022-26962

The Italtel NFV 11.1.2-20210318 software is vulnerable to Multiple Stored XSS within the NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS endpoint. The root cause is the improper neutralization of input through the name , username , or mrfAnnouncementName para...

Google Chrome V8 Engine Code Execution

The vulnerability in Google Chrome’s V8 JavaScript engine handler is related to buffer overflow. Exploitation of this vulnerability allows a remote attacker to execute arbitrary code via a specially crafted HTML page...

PT-2026-89573

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes untrusted input inside template content nested in...

CVE-2026-88058: Improper Neutralization of Input During Web Page Generation

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback...