WS-2020-0010

All versions of simple-crypto-js use AES-CBC with PKCS7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data...

WS-2019-0341

Cross-Site Scripting vulnerability found in nextcloud-vue-collections before 0.4.2. The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's...

WS-2019-0316

In saml2-js, versions prior to v2.0.5 are vulnerable to authentication bypass due the failure of enforcement of assertion conditions...

WS-2019-0208

bpmn-js-properties-panel before 0.31.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...

WS-2019-0207

cmmn-js-properties-panel before 0.8.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...

WS-2019-0206

dmn-js-properties-panel before 0.3.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...

WS-2019-0175

diagram-js versions 2.x before 2.6.2 and 3.x before 3.3.1 fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript...

WS-2019-0148

diagram-js-direct-editing versions before 1.4.3 fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser...

@dotgov/bpmn (>=0.0.1, <=0.0.29), @dotgov/z_bpmn (>=0.0.1, <=2.0.0) +14 more potentially affected by unknown CVE via diagram-js-direct-editing (>=0.4.0, <=0.23.0)

diagram-js-direct-editing NPM version =0.4.0, =0.0.1, =0.0.1, =1.0.0, =0.5.0, =1.20.7, =0.7.2, =1.0.0, =1.0.0, =0.2.2, =0.0.7, =2.0.0, =2.2.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0148...

WS-2017-0278

Affected versions of the js-quantities package all, are vulnerable to Out-Of-Memory attacks...

PT-2026-41138

Name of the Vulnerable Software and Affected Versions Fides versions 2.33.0 through 2.84.4 Description A DOM-based Cross-Site Scripting XSS issue exists in fides.js, the script used to render consent banners. The problem occurs when the fides description variable is overridden via a URL query...

WS-2017-0125

It was possible to run arbitrary JS from inside angular expressions using the Object.getOwnPropertyDescriptor method since commit 4ab16aa...

CVE-2026-44009 vm2: Sandbox Breakout Through Null Proto Exception

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2...

CVE-2026-44003 vm2: Transformer Fast-Path Bypass Exposes Internal State Variable

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to directly access the internal...

CVE-2026-44575

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment...

CVE-2026-44581

CVE-2026-44581 details a stored XSS in Next.js App Router apps relying on CSP nonces when deployed behind shared caches. Affected versions are 13.4.0–before 15.5.16 and 16.2.5; malformed nonce values derived from request headers could be reflected into rendered HTML, enabling cache-poisoning and ...

CVE-2026-44580 Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escap...

CVE-2026-44579

Next.js vulnerability CVE-2026-44579 affects Next.js releases prior to 15.5.16 and 16.2.5 where Partial Prerendering via Cache Components can cause a connection-exhaustion DoS through crafted POST requests to a server action. A malicious request may trigger a request-body handling deadlock, leavi...

CVE-2026-44578

CVE-2026-44578 affects Next.js self-hosted deployments using the built-in Node.js server. The issue enables server-side request forgery via crafted WebSocket upgrade requests, allowing an attacker to proxy requests to internal or external destinations and potentially expose internal services or c...

CVE-2026-44574

Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the...