CVE-2026-65606

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, SiYuan Desktop opens a custom tab and inserts the link’s icon parameter into the tab header via innerHTML without ...

EUVD-2026-48242

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

CVE-2026-65606

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

CVE-2026-65606 SiYuan before v3.7.2 Cross-Site Scripting to RCE

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

CVE-2026-65605 SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

CVE-2026-65605

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

EUVD-2026-48241

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

CVE-2026-64806

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module @hono/node-server

Summary IBM App Connect Enterprise runtime is vulnerable to multiple vulnerabilities due to Node.js module @hono/node-server. Vulnerability Details CVEID:CVE-2026-54286 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, on Windows...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules multer, form-data, protobufjs and tar. Vulnerability Details...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html (CVE-2026-53606 & CVE-2026-42338)

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html. Vulnerability Details CVEID:CVE-2026-53606...

DoS (Denial of Service) tar Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.5, 9.5.1, 10.1.2, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H...

Denial of Service (DoS) tar Dependency in Confluence Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.5, 9.5.1, 10.1.2 and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

DoS (Denial of Service) tar Dependency in Confluence Data Center

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity DoS Denial of Service vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.5, 9.5.1, 10.1.2, and 10.2.0 of...

Malicious Package

Overview fs-extra-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11030 Malicious code in vitest-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e61d93e82877f836aaba3dd528e79f3e5f4b1bd12ce64b40202bbecd08a2747 Package published as vitest-axios re-ships axios source, README, homepage, and repository metadata to impersonate the legitimate axios HTTP client. I...

MAL-2026-11029 Malicious code in lychee-norm-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containin...

MAL-2026-11024 Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 172586ef83140a92d732376efb734e45aa09958a7800016aa3c229ccf74c81bf Package presents itself as a create--project scaffolder but ships no scaffolding functionality. The bin/run.js entry, invoked when a user runs npx...

Malicious code in da-sc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6af0c0528114fb5ac6296c3390b435a78ce9dc9f0d90fc606a6cf5d05b3472f0 No a static rule matches and no behavioral findings were produced for this package version. With no evidence of exfiltration, install-time remote cod...

Malicious code in ethers-packge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534b72f9b5ef702509f5868e85ff740c59e1e6c1f871ad0999253a062254aacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...