CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100174 Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

Malicious code in chromatitle-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173 src/index.js unconditionally invokes bootstrap from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with...

MAL-2026-17174 Malicious code in chromatitle-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eff7b9f53e0aed7a8a1c48ae92851ea0ed67b86566d208c78329ecb1b8a73173 src/index.js unconditionally invokes bootstrap from src/utils/bootstrap.js at module load time. bootstrap.js is heavily obfuscated with...

OESA-2026-4060 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. From 3.0...

CVE-2026-67410: Exposure of Sensitive Information to an Unauthorized Actor

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecre...

CVE-2026-100176: Improper Neutralization of Input During Web Page Generation

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

PT-2026-98919

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description An information exposure occurs when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured Identity Provider IDP uses a client...

Linux Distros Unpatched Vulnerability : CVE-2026-97058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeErro...

sprintf-js vulnerable to denial of service through unbounded precision specifiers

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

GHSA-HP3W-G68C-FV3C sprintf-js vulnerable to denial of service through unbounded precision specifiers

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

CVE-2026-97058

A flaw was found in sprintf-js. A remote attacker, by controlling format strings, can inject precision values that exceed ECMAScript limits. This lack of validation leads to uncaught RangeError exceptions, allowing the attacker to abort calling operations with a minimal payload, resulting in a...

AZL-105254 CVE-2026-97058 affecting package python-tensorboard 2.16.2-6

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

CVE-2026-97058

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

AZL-105069 CVE-2026-97058 affecting package js-jquery 3.5.0-4

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

UBUNTU-CVE-2026-97058

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

CVE-2026-97058 sprintf-js through 1.1.3 Denial of Service via Unbounded Precision

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

CVE-2026-97058 sprintf-js through 1.1.3 Denial of Service via Unbounded Precision

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...

CVE-2026-97058

The sprintf-js library (through version 1.1.3 ) is vulnerable to a Denial of Service (DoS) condition because it passes unbounded precision specifiers to the toFixed , toExponential , and toPrecision methods without proper validation. An attacker capable of controlling the format strings can injec...

CVE-2026-97058 sprintf-js through 1.1.3 Denial of Service via Unbounded Precision

sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...