CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...

CVE-2026-15037 XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

CVE-2026-15037

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

CVE-2026-65606 SiYuan before v3.7.2 Cross-Site Scripting to RCE

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

EUVD-2026-48242

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

CVE-2026-65606

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, SiYuan Desktop opens a custom tab and inserts the link’s icon parameter into the tab header via innerHTML without ...

CVE-2026-65606 SiYuan before v3.7.2 Cross-Site Scripting to RCE

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without...

CVE-2026-65605 SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

EUVD-2026-48241

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

CVE-2026-64806

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules multer, form-data, protobufjs and tar. Vulnerability Details...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html (CVE-2026-53606 & CVE-2026-42338)

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html. Vulnerability Details CVEID:CVE-2026-53606...

MAL-2026-11030 Malicious code in vitest-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e61d93e82877f836aaba3dd528e79f3e5f4b1bd12ce64b40202bbecd08a2747 Package published as vitest-axios re-ships axios source, README, homepage, and repository metadata to impersonate the legitimate axios HTTP client. I...

MAL-2026-11029 Malicious code in lychee-norm-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containin...

MAL-2026-11024 Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 172586ef83140a92d732376efb734e45aa09958a7800016aa3c229ccf74c81bf Package presents itself as a create--project scaffolder but ships no scaffolding functionality. The bin/run.js entry, invoked when a user runs npx...

Malicious code in da-sc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6af0c0528114fb5ac6296c3390b435a78ce9dc9f0d90fc606a6cf5d05b3472f0 No a static rule matches and no behavioral findings were produced for this package version. With no evidence of exfiltration, install-time remote cod...

MAL-2026-11026 Malicious code in ethers-packge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534b72f9b5ef702509f5868e85ff740c59e1e6c1f871ad0999253a062254aacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11023 Malicious code in bs58-88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d1dec3ae934b73d28ddd4c002cf93f9a9be597731434f5cfead7fdbb11954f Package bs58-88 mimics the popular bs58 base58 encoder: README, keywords, and repository URL match the real bs58, and index.cjs re-exports...

MAL-2026-11021 Malicious code in @bcryptln/bcryptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8447904424d1fd6085c58e7a0adec80bad268c96395c885d104ee80da79c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-63960

Name of the Vulnerable Software and Affected Versions JetBrains WebStorm versions prior to 2026.2 Description Arbitrary code execution is possible before granting project trust through the configured Node.js interpreter. Recommendations Update JetBrains WebStorm to version 2026.2...