Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

CVE-2026-14939

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

CVE-2026-14939

The Visualizer WordPress plugin is affected: versions before 4.0.6 expose a vulnerability where an attacker with Contributor-level access can supply a URL that is not validated to safe address ranges, enabling server-side requests (SSRF) to link-local instance-metadata endpoints. The fetched resp...

EUVD-2026-52588

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

CVE-2026-14939 Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

Important: Red Hat Security Advisory: osbuild-composer security, bug fix, and enhancement update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

CVE-2026-67338

A flaw was found in JupyterLab. The Extension Manager fails to validate URI protocols in package metadata URLs. This allows attackers to publish malicious PyPI packages containing javascript: URLs in their project metadata. When a user clicks on the extension name, arbitrary JavaScript code can b...

CVE-2026-67972

An issue in the CFCFDPRecvMd component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure...

CVE-2026-18736 Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the compiler's i18n metadata collection path, which lets event-handler attributes be marked translatable with i18n-on such as i18n-onerror, bypassing the validation that normally blocks binding to event-handl...

CVE-2026-68585

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID...

JLSEC-2026-1107

In LibRaw, there is an out-of-bounds read vulnerability within the "LibRaw::parseSonySRF" function libraw\src\metadata\sony.cpp when processing srf files...

CVE-2026-68585

Affected product/versions: SiYuan before v3.7.3. Vulnerable endpoint: /api/block/getBlockInfo. Root cause: endpoint returns document root metadata (including title) for publish-forbidden documents without publish-access checks. Impact: anonymous readers or publish RoleReader tokens can query a bl...

CVE-2026-68585 SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID...

CVE-2026-68585

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID...

EUVD-2026-52273

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID...

CVE-2026-68585 SiYuan before v3.7.3 Metadata Disclosure via getBlockInfo

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...