SUSE SLES16 Security Update : python-mistune (SUSE-SU-2026:22655-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22655-1 advisory. This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in...

DEBIAN-CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

MAL-2026-10726 Malicious code in astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 949822741657acf4a6b9f6255a2f7a080ca1cc3343e9663020c5e21ce2a6b03c This tarball is published as [email protected] but does not match the legitimate withastro/astro project which is on the v5.x line and depends on picocolor...

Malicious code in astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 949822741657acf4a6b9f6255a2f7a080ca1cc3343e9663020c5e21ce2a6b03c This tarball is published as [email protected] but does not match the legitimate withastro/astro project which is on the v5.x line and depends on picocolor...

EUVD-2026-45003

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

PT-2026-60484

Name of the Vulnerable Software and Affected Versions @prompty/core versions 2.0.0-alpha.1 through 2.0.0-beta.2 Description The @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts uses gray-matter without overriding executable js and javascript frontmatter...

Linux Distros Unpatched Vulnerability : CVE-2026-48801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON...

sysreptor v2026.55

An easy and customizable pentest reporting platform designed to simplify pentest report creation for security professionals. Playground • Ideas • Questions • Documentation • Features and Pricing • Installation • Buy SysReptor SysReptor is a fully customizable pentest reporting platform designed f...

CVE-2026-48801

A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of ON² for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker...

ROOT-APP-NPM-CVE-2026-48988 CVE-2026-48988 in @rootio/markdown-it - Patched by Root

Root has patched CVE-2026-48988 in the @rootio/markdown-it package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-2327 CVE-2026-2327 in @rootio/markdown-it - Patched by Root

Root has patched CVE-2026-2327 in the @rootio/markdown-it package for Root:npm. Multiple fixed versions available...

CVE-2026-46637

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with issafe = all, causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly...

CVE-2026-46637

CVE-2026-46637 concerns Twig (PHP template engine). Before 3.26.0, the filters in twig/markdown-extra (html_to_markdown, markdown_to_html) and twig/cssinliner-extra (inline_css) were registered with is_safe => [all], causing their output to be treated as safe in contexts where escaping is requ...

EUVD-2026-44509

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with issafe = all, causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly...

CVE-2026-46637

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with issafe = all, causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly...

CVE-2026-46637

Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with issafe = all, causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly...

CVE-2026-48801

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON² algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs...

CVE-2026-48801

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON² algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs...

UBUNTU-CVE-2026-48801

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON² algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs...

EUVD-2026-44454

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON² algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs...