PT-2026-63559

Name of the Vulnerable Software and Affected Versions Next.js versions 15.5.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When self-hosting with the default image loader, the Image Optimization API can optimize remotely hosted images if configured. Malicious content within...

RockyLinux 9 : webkit2gtk3 (RLSA-2026:42062)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:42062 advisory. Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash...

PT-2026-63511

Name of the Vulnerable Software and Affected Versions danger danger-js versions prior to 13.0.8 Description An OS command injection issue exists in the CLI component within the danger.git.diffForFile function located in the source/platforms/git/localGetFileAtSHA.ts file. This occurs when the File...

EUVD-2026-46151

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

GHSA-3JXR-9VMJ-R5CP brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

Summary brace-expansion's expand exhibits exponential-time - O2ⁿ - behavior in the number of consecutive non-expanding groups. A short, all-ASCII input 90 bytes/30 groups blocks the calling thread for minutes; a slightly longer input hangs it effectively indefinitely. Because the dominant consume...

nodejs: Node.js: Certification validation bypass in TLS host verification

A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security TLS host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integri...

MAL-2026-10878 Malicious code in @dxcl/transaction-js (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10877 Malicious code in @dxcl/log-function-js (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10873 Malicious code in @dxcl/customer-js (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10874 Malicious code in @dxcl/fund-js (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10872 Malicious code in @dxcl/account-js (npm)

--- -= Per source details. Do not edit below this line.=-...

ROOT-APP-NPM-AIKIDO-2026-10754 AIKIDO-2026-10754 in next - Patched by Root

Root has patched AIKIDO-2026-10754 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-47831 CVE-2024-47831 in next - Patched by Root

Root has patched CVE-2024-47831 in the next package for Root:npm. Multiple fixed versions available...

CVE-2026-46421

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]....

CVE-2026-46421

The CVE concerns a supply-chain compromise in the SAP Cloud Application Programming Model’s cap-js/cds-dbs monorepo. On 2026-04-29, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published; these malicious packages harvested credentials (n...

nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames

A flaw was found in Node.js. A malicious server can exploit the HTTP/2 client by sending an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client, resulting in a denial of service...

MAL-2026-10637 Malicious code in mc-reg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93ca15954536abe30ea5c7f5bc5a06192f3946c98d74edef9d90edbc52cb9d95 mc-reg advertises itself as a Cosmos chain-registry data package README shows chain-registry-style assets/chains/ibc API, but its main and ESM...

ALSA-2026:39868 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

CVE-2026-48125

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application th...

CVE-2026-48125 UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application th...