ROOT-APP-NPM-CVE-2026-27977 CVE-2026-27977 in next - Patched by Root

Root has patched CVE-2026-27977 in the next package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview epic-common-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-19970

A flaw was found in Open Asset Import Library Assimp. A heap-based buffer overflow vulnerability exists in the AddBonesToNodeGraph3DGSMDL7 function within the Node Parser component. This flaw can be triggered remotely by manipulating the bonesnum argument. Successful exploitation could lead to...

CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

DEBIAN-CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

UBUNTU-CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970 Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970 Open Asset Import Library Assimp Node MDLLoader.cpp AddBonesToNodeGraph_3DGS_MDL7 heap-based overflow

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

EUVD-2026-60021

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-19970

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

CVE-2026-35219: Server-Side Request Forgery (SSRF)

Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and...

nodejs22 security update

1:22.23.1-4.0.1 - Add c-ares as dependency orabug 39781219 1:22.23.1-6 - Fix for CVE-2026-69152 1:22.23.1-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:22.23.1-4 - Fix CVE-2026-13149 npm/brace-expansion 1:22.23.1-3 - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 node-tar...

CVE-2026-19970: Heap-based Buffer Overflow

A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bonesnum results in heap-based buffer...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100184)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100184 advisory. In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a kernel b...

Linux Distros Unpatched Vulnerability : CVE-2026-19970

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph3DGSMDL7 of the file...

EUVD-2026-59802

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code...

EUVD-2026-59801

SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node...

EUVD-2026-59794

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitra...