Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses js-yaml-4.1.1.tgz, tar-7.5.15.tgz, ujson-5.12.1-cp311-cp311-manylinux224x8664.manylinux228x8664.whl, decode-uri-component-0.2.2.tgz and body-parser-1.20.5.tgz which are vulnerable to CVE-2026-53550, CVE-2026-53655, CVE-2026-54911, CVE-2026-45822 and CVE-2026-12590...

CVE-2026-48996

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an...

CVE-2026-48996 Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an...

PYSEC-2026-3747

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

CVE-2026-79720

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

PYSEC-2026-3747

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

PYSEC-2026-4001

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

CVE-2026-79718

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

CVE-2026-79719

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

PYSEC-2026-4002

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

PYSEC-2026-4001

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

PYSEC-2026-4002

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

Affected versions 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to...

EUVD-2026-67092

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

CVE-2026-79720

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

CVE-2026-79720

Netron versions

CVE-2026-79720

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

CVE-2026-79720

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

CVE-2026-79719

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

EUVD-2026-67091

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...