WS-2018-0625

The package xmlbuilder-js before 9.0.5 is vulnerable to denial of service due to a regular expression issue...

WS-2020-0050

1337qq-js is a malicious package, on Unix systems the package allows remote attackers to disclose sensitive information...

WS-2020-0010

All versions of simple-crypto-js use AES-CBC with PKCS7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data...

WS-2019-0341

Cross-Site Scripting vulnerability found in nextcloud-vue-collections before 0.4.2. The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's...

WS-2019-0316

In saml2-js, versions prior to v2.0.5 are vulnerable to authentication bypass due the failure of enforcement of assertion conditions...

WS-2019-0208

bpmn-js-properties-panel before 0.31.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...

WS-2019-0207

cmmn-js-properties-panel before 0.8.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...

WS-2019-0206

dmn-js-properties-panel before 0.3.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...

WS-2019-0175

diagram-js versions 2.x before 2.6.2 and 3.x before 3.3.1 fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript...

WS-2019-0148

diagram-js-direct-editing versions before 1.4.3 fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser...

@dotgov/bpmn (>=0.0.1, <=0.0.29), @dotgov/z_bpmn (>=0.0.1, <=2.0.0) +14 more potentially affected by unknown CVE via diagram-js-direct-editing (>=0.4.0, <=0.23.0)

diagram-js-direct-editing NPM version =0.4.0, =0.0.1, =0.0.1, =1.0.0, =0.5.0, =1.20.7, =0.7.2, =1.0.0, =1.0.0, =0.2.2, =0.0.7, =2.0.0, =2.2.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0148...

WS-2017-0278

Affected versions of the js-quantities package all, are vulnerable to Out-Of-Memory attacks...

PT-2026-41138

Name of the Vulnerable Software and Affected Versions Fides versions 2.33.0 through 2.84.4 Description A DOM-based Cross-Site Scripting XSS issue exists in fides.js, the script used to render consent banners. The problem occurs when the fides description variable is overridden via a URL query...

WS-2017-0125

It was possible to run arbitrary JS from inside angular expressions using the Object.getOwnPropertyDescriptor method since commit 4ab16aa...

CVE-2026-44009 vm2: Sandbox Breakout Through Null Proto Exception

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2...

CVE-2026-44003 vm2: Transformer Fast-Path Bypass Exposes Internal State Variable

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to directly access the internal...

CVE-2026-44575

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment...

CVE-2026-44581

CVE-2026-44581 details a stored XSS in Next.js App Router apps relying on CSP nonces when deployed behind shared caches. Affected versions are 13.4.0–before 15.5.16 and 16.2.5; malformed nonce values derived from request headers could be reflected into rendered HTML, enabling cache-poisoning and ...

CVE-2026-44580 Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escap...

CVE-2026-44579

Next.js vulnerability CVE-2026-44579 affects Next.js releases prior to 15.5.16 and 16.2.5 where Partial Prerendering via Cache Components can cause a connection-exhaustion DoS through crafted POST requests to a server action. A malicious request may trigger a request-body handling deadlock, leavi...