EUVD-2026-36797

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service DoS condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is...

@alok5953/videoextract (>=1.0.0, <=1.0.7), @aspects-ai/workspace-cli (>=0.1.17, <=0.1.24) +27 more potentially affected by CVE-2026-30121 via @remotion/studio-server (>=4.0.91, <=4.0.409)

@remotion/studio-server NPM version =4.0.91, =1.0.0, =0.1.17, =1.0.0, =1.0.0, =0.1.4, =0.1.3, =0.1.4, =0.1.0, =3.0.4, =4.0.91, =4.0.91, =4.0.91, =4.0.260, =1.0.0, =1.0.20 and more Source cves: CVE-2026-30121 Source advisory: SNYK:JS-REMOTIONSTUDIOSERVER-17817236...

@0xwork/connect (>=0.1.0, <=0.1.8), @7n/rules (>=1.0.0, <=1.118.11) +449 more potentially affected by CVE-2026-48988 via markdown-it (>=14.0.0, <=14.1.1)

markdown-it NPM version =14.0.0, =0.1.0, =1.0.0, =4.10.0, =2026.4.23-zh, =2.3.0, =1.0.0, =0.25.7, =0.12.2, =3.0.0, =1.6.8, =0.1.1, =0.1.1, =8.1.3, =8.4.0 and more Source cves: CVE-2026-48988 Source advisory: SNYK:JS-MARKDOWNIT-17353909...

NPM: Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

NPM: Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow vulnerability discovered by ? in WordPress Npm electron versions = 42.3.1, 42.3.3...

CVE-2026-41708

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service DoS condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is...

@aircall/http (1.7.7), @breadstone/archipel-platform-analytics (>=0.0.2, <=0.0.13) +60 more potentially affected by CVE-2026-48125 via ua-parser-js (>=2.0.1, <=2.0.9)

ua-parser-js NPM version =2.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.5.9-develop-pedago.20260213101441, =0.2.2-develop-pedago.2, =1.0.2-develop.0.20260622083059 and more Source cves: CVE-2026-48125 Source advisory:...

NPM: UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

NPM: UAParser.js: Unbounded Sec-CH-UA-Model parsing can trigger ReDoS in withClientHints vulnerability discovered by ? in WordPress Npm ua-parser-js versions = 2.0.1, 2.0.10...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1542 more potentially affected by CVE-2026-54271 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54271 Source advisory: SNYK:JS-PROTOBUFJSCLI-17362836...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1129 more potentially affected by CVE-2026-54271 via protobufjs (>=8.0.0, <=8.4.2)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-54271 Source advisory: SNYK:JS-PROTOBUFJS-17362837...

@a1st/aix (>=0.0.3, <=0.8.0), @a1st/aix-core (>=0.2.0, <=0.8.0) +122 more potentially affected by CVE-2026-53633 via vitest (>=4.0.0-beta.7, <=4.1.7)

vitest NPM version =4.0.0-beta.7, =0.0.3, =0.2.0, =0.0.21, =0.79.1, =2.1.0-alpha.278, =2.1.0-alpha.281 and more Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITEST-17375131...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2216 more potentially affected by CVE-2026-65900 via dompurify (>=3.0.0, <=3.4.7)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =6.3.4 and more Source cves: CVE-2026-65900 Source advisory: OSV:GHSA-GVMJ-G25R-R7WR...

@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +139 more potentially affected by CVE-2026-82661 via nodemailer (>=8.0.0, <=8.0.8)

nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.210-alpha and more Source cves: CVE-2026-82661 Source advisory: OSV:GHSA-268H-HP4C-CRQ3...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1542 more potentially affected by CVE-2026-54269 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54269 Source advisory: OSV:GHSA-F38Q-MGVJ-VPH7...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-50555 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-50555 Source advisory: OSV:GHSA-HQR9-C56F-3X7F...

02.aula (1.0.0), 0xrtest (1.0.0) +10478 more potentially affected by CVE-2026-53550 via js-yaml (>=4.0.0, <=4.1.1)

js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: CVE-2026-53550 Source advisory: SNYK:JS-JSYAML-17342520...

CVE-2026-5233 Missing Rate Limiting in Mia Technologies' Pizzy Library

Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250...

mysql: Optimizer unspecified vulnerability (CPU Apr 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network...

CVE-2026-53520 Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0...

org.webjars.npm:github-com-nhn-tui-image-editor (3.10.1), org.webjars.npm:tui-image-editor (3.15.3) potentially affected by CVE-2026-44311 via org.webjars.npm:fabric (>=3.6.0, <=4.5.0)

org.webjars.npm:fabric MAVEN version =3.6.0, =4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:fabric and may be impacted: - org.webjars.npm:github-com-nhn-tui-image-editor 3.10.1 - org.webjars.npm:tui-image-editor 3.15.3 Source...

@lifesg/web-frontend-engine (>=2.2.4, <=2.2.5), @osdlabel/react (0.0.1) +2 more potentially affected by CVE-2026-44311 via fabric (>=7.1.0, <=7.2.0)

fabric NPM version =7.1.0, =2.2.4, =2.2.5 - @osdlabel/react 0.0.1 - @osdlabel/solid 0.0.1 - osdlabel 0.0.1 Source cves: CVE-2026-44311 Source advisory: OSV:GHSA-W22M-HVVM-XMWX...