196376 matches found
6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1080 more potentially affected by CVE-2026-83607 via @xmldom/xmldom (>=0.9.0, <=0.9.10)
@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83607 Source advisory: SNYK:JS-XMLDOMXMLDOM-19499075...
6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1082 more potentially affected by CVE-2026-83608 via @xmldom/xmldom (>=0.9.0, <=0.9.11)
@xmldom/xmldom NPM version =0.9.0, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =2.0.2, =0.8.1, =0.1.0, =0.8.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-83608 Source advisory: SNYK:JS-XMLDOMXMLDOM-19498556...
2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4337 more potentially affected by CVE-2026-83619 via @xmldom/xmldom (>=0.7.0, <=0.8.14)
@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.12.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-83619 Source advisory: SNYK:JS-XMLDOMXMLDOM-19498558...
CLSA-2026-1788274092 TuxCare security update for org.springframework (20 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 20 CVEs. Fixed in 6.1.15-tuxcare.4...
13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites that install those libraries and initiate the deployment of spyware aimed at unpatched iOS devices. "The...
CLSA-2026-1788255151 TuxCare security update for 12 packages (1 CVE)
TuxCare rebuilt 12 packages to address 1 CVE. Fixed in 7.5.1-tuxcare.9...
CLSA-2026-1788251580 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.5.11-tuxcare.1...
@pnpm/building.commands (>=1100.0.0, <=1100.1.8), @pnpm/deps.compliance.commands (>=1100.0.0, <=1101.5.1) +10 more potentially affected by CVE-2026-82393 via @pnpm/installing.deps-resolver (>=1100.0.0, <=1100.2.6)
@pnpm/installing.deps-resolver NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-82393 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSRESOLVER-19477039...
CLSA-2026-1788216921 TuxCare security update for io.netty (28 CVEs)
TuxCare rebuilt 46 io.netty packages to address 28 CVEs. Fixed in 4.1.79.Final-tuxcare.2...
@3kles/3kles-socketio (>=2.1.5, <=2.4.1), @5minds/processcube_engine (>=16.0.0-alpha.2, <=18.0.0-renovate-fc9b99-lz9hhvt1) +250 more potentially affected by CVE-2026-59724 via engine.io (>=6.5.1, <=6.6.6)
engine.io NPM version =6.5.1, =2.1.5, =16.0.0-alpha.2, =2.17.13, =1.16.10, =3.0.4, =2.0.28, =1.1.5-13, =0.1.0, =0.1.0, =0.1.0, =1.2.0, =12.0.1, =17.0.0 and more Source cves: CVE-2026-59724 Source advisory: OSV:GHSA-GR94-W7QR-F4J3...
GHSA-GJHQ-GJFW-99MQ vulnerabilities
Vulnerabilities for packages: k9s, kyverno, nerdctl, opentelemetry-collector, k3s, flux-source-controller, kine, kaf, snyk-cli, cert-manager, kubernetes, rancher-agent, external-dns, prometheus-operator, rclone, gitea, kubernetes-dashboard, helm, flux, loki, aactl, gitness, kubevela, sftpgo,...
GHSA-GJHQ-GJFW-99MQ vulnerabilities
Vulnerabilities for packages: tigera-operator, spire-server, prometheus, rclone-fips, drone-fips, tbot, skaffold, skaffold-fips, kubescape-server-fips, aactl, kine, argocd-image-updater, telegraf, flux-source-controller-fips, kubescape, kaf, flux-notification-controller, k3s, kubernetes,...
CVE-2026-82653
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...
CVE-2026-82653 SiYuan before v3.8.1 Stored XSS via confirmDialog
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...
CVE-2026-82653
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...
CVE-2026-82653 SiYuan before v3.8.1 Stored XSS via confirmDialog
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...
EUVD-2026-68239
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...
CVE-2026-82653
SiYuan before v3.8.1 is affected by a stored cross-site scripting (XSS) vulnerability in the confirmDialog() function. Unescaped package names and notebook names are interpolated directly into innerHTML assignments, allowing attackers to submit malicious bazaar packages with HTML/script payloads ...
CVE-2026-82653 SiYuan before v3.8.1 Stored XSS via confirmDialog
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...