Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100889)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100889 advisory. Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142,...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101088)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101088 advisory. Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100901)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100901 advisory. JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101103)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101103 advisory. Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and...

ROOT-APP-NPM-CVE-2023-26133 CVE-2023-26133 in progressbar.js - Patched by Root

Root has patched CVE-2023-26133 in the progressbar.js package for Root:npm. Multiple fixed versions available...

MINI-V8FX-V4MR-XGW2

Bulletin has no description...

MINI-V8V8-CH32-4P59

Bulletin has no description...

Exploit for CVE-2022-24481

No d...

Basecamp: One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML

A cross-account JavaScript execution vulnerability was discovered in a web application that allowed arbitrary code execution when a victim opened a crafted public board URL. An attacker with a separate account could leverage this vulnerability to steal the victim's write access token through a...

EUVD-2026-59800

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-73052

CVE-2026-73052 concerns SiYuan before v3.7.4. The issue arises because attribute-view field names are stored without HTML escaping and are interpolated into option elements via innerHTML in the sort menu. This allows stored XSS: an attacker can rename a database field to inject markup, which can ...

CVE-2026-73050 SiYuan before v3.7.4 Stored XSS via select option color

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-73050 SiYuan before v3.7.4 Stored XSS via select option color

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-73050

CVE-2026-73050 affects SiYuan before v3.7.4, where the color field in attribute-view select options is not validated/escaped, allowing stored XSS via eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, enabling arbitrary Jav...

Malicious code in adxaa (npm)

Source: amazon-inspector 52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9 The tarball stages an obfuscated JavaScript payload i.js, with an un-obfuscated copy in original.js that gates on window.location.href containing 'noviembrenacional.com' and then, using the victim's...

Cross-Site Scripting (XSS)

Spring Web Flow is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the JavaScript RemotingHandler rendering error-response bodies as HTML even when the response is not text/html, which allows an attacker to exploit the issue by injecting malicious input that is reflected in...

Jenkins Dependency Graph Viewer Plugin: XSS

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins...

PT-2026-73055

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape the color field in attribute-view select options across eight unescaped render sites. An attacker can inject event-handle...

CVE-2026-73050: Improper Neutralization of Input During Web Page Generation

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-50029 js-toml has silent type confusion via falsy-primitive duplicate-key bypass

js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with if objectkey instead of if key in object. When the prior value is a falsy primitive — false, 0, 0n, 0.0, -0, or "" — the duplicate-key branch is...