5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +247 more potentially affected by CVE-2026-84369 via svgo (>=3.0.0, <=3.3.3)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-84369 Source advisory: SNYK:JS-SVGO-19498536...

1-topshiriq (1.0.0), 3nit-utils (>=0.11.1, <=0.23.0) +4170 more potentially affected by CVE-2026-84367 via joi (>=14.3.1, <=17.13.4)

joi NPM version =14.3.1, =0.11.1, =0.0.1, =2.0.0, =0.1.2, =2.0.11, =0.1.6-alpha.2, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.9 and more Source cves: CVE-2026-84367 Source advisory: SNYK:JS-JOI-19498547...

CVE-2026-67312 vulnerabilities

Vulnerabilities for packages: awx, kubeflow-centraldashboard, azurite, langfuse, prism, arangodb, semaphore, gitlab-rails-ce-fips, kibana, jitsucom-jitsu, opensearch-dashboards, wazuh-dashboard, gitlab-rails-ce, lerna, opensearch-dashboards-fips, wazuh-dashboard-fips, librechat, langfuse-fips,...

GHSA-F2R5-PQH9-R8F8 vulnerabilities

Vulnerabilities for packages: awx, kubeflow-centraldashboard, azurite, langfuse, prism, arangodb, semaphore, gitlab-rails-ce-fips, kibana, jitsucom-jitsu, opensearch-dashboards, wazuh-dashboard, gitlab-rails-ce, lerna, opensearch-dashboards-fips, wazuh-dashboard-fips, librechat, langfuse-fips,...

CVE-2026-67312 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server, prism, lerna, langfuse, kubeflow-centraldashboard, jitsucom-jitsu...

CVE-2026-67316 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server, prism, lerna, langfuse, kubeflow-centraldashboard, jitsucom-jitsu...

GHSA-F2R5-PQH9-R8F8 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server, prism, lerna, langfuse, kubeflow-centraldashboard, jitsucom-jitsu...

CLSA-2026-1788274092 TuxCare security update for org.springframework (20 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 20 CVEs. Fixed in 6.1.15-tuxcare.4...

13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds

Cybersecurity researchers have identified a set of 13 malicious Composer theme packages on Packagist that are designed to inject JavaScript into Vietnamese movie and comic streaming sites that install those libraries and initiate the deployment of spyware aimed at unpatched iOS devices. "The...

CLSA-2026-1788251580 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.5.11-tuxcare.1...

CLSA-2026-1788216921 TuxCare security update for io.netty (28 CVEs)

TuxCare rebuilt 46 io.netty packages to address 28 CVEs. Fixed in 4.1.79.Final-tuxcare.2...

GHSA-GJHQ-GJFW-99MQ vulnerabilities

Vulnerabilities for packages: kaf, flux-notification-controller, flux-image-automation-controller, kubevela, rclone, argocd-image-updater, kubescape, nerdctl, loki, kubernetes, snyk-cli, skaffold, external-dns, kine, sftpgo, fscrypt, gitea, aactl, flux-source-controller, chisel, kyverno, helm, k9...

GHSA-GJHQ-GJFW-99MQ vulnerabilities

Vulnerabilities for packages: flux, coder, gitea-fips, fscrypt, cilium, sftpgo, frankenphp-8.4, reports-server, frankenphp-8.2, kube-conformance, cg, falco-no-driver, backup-restore-operator, k9s, crossplane-cli, gitness, external-dns, kubernetes-dashboard, kyverno, k9s-fips, prometheus, nerdctl,...

CVE-2026-82653

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

CVE-2026-82653 SiYuan before v3.8.1 Stored XSS via confirmDialog

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

CVE-2026-82653

SiYuan before v3.8.1 is affected by a stored cross-site scripting (XSS) vulnerability in the confirmDialog() function. Unescaped package names and notebook names are interpolated directly into innerHTML assignments, allowing attackers to submit malicious bazaar packages with HTML/script payloads ...

EUVD-2026-68239

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

CVE-2026-82653 SiYuan before v3.8.1 Stored XSS via confirmDialog

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute...

RHSA-2026:60853 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

MGASA-2026-0341 Updated golang packages fix security vulnerabilities

CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary...