DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

If the HTML you give it contains a element, and inside that template there's an element with a shadow DOM attached to it, DOMPurify quietly skips over the shadow contents. Whatever the attacker put in there - an image with an onerror handler, a link with a javascript: URL, even a full script -...

GHSA-RP9W-3FW7-7CWQ DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

If the HTML you give it contains a element, and inside that template there's an element with a shadow DOM attached to it, DOMPurify quietly skips over the shadow contents. Whatever the attacker put in there - an image with an onerror handler, a link with a javascript: URL, even a full script -...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2175 more potentially affected by unknown CVE via dompurify (>=3.0.0, <=3.4.7)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =0.2.10 and more Source cves: unknown CVE Source advisory: SNYK:JS-DOMPURIFY-17342528...

Trust Boundary Violation

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Trust Boundary Violation in the sanitize function when handling DOM nodes from a different same-origin realm due to improper realm-bound instanceof checks. An attacker can...

GHSA-W7VC-732C-9M39

creationtimestamp| type| source ---|---|--- 2026-06-15 19:41:20+00:00| seen| https://gist.github.com/alon710/65e78fc78054322fc9a9e7b7f341ade1 2026-06-15 19:51:29+00:00| seen| https://gist.github.com/alon710/9d5d358571e9a39984e3ba8848038e82 2026-06-15 20:01:21+00:00| seen|...

DEBIAN-CVE-2026-6039

LibreOffice can import drawings in the DXF format used by CAD software. A heap buffer overflow existed when importing a DXF polyline. The point count taken from the file was truncated to a 16-bit value when the point buffer was sized, while the full count was used to fill it, so a polyline whose...

GHSA-268H-HP4C-CRQ3

creationtimestamp| type| source ---|---|--- 2026-06-15 18:11:22+00:00| seen| https://gist.github.com/alon710/c427aa6118bf0e273bdc93bc35772150 2026-06-15 18:21:39+00:00| seen| https://gist.github.com/alon710/af634e90c0bab5733aa7b5794a1ffb98 2026-06-15 18:31:11+00:00| seen|...

GHSA-FHV5-28VV-H8M8

creationtimestamp| type| source ---|---|--- 2026-06-15 17:41:21+00:00| seen| https://gist.github.com/alon710/1f95260cf4713d452e9aa65f49fefae4 2026-06-15 23:21:16+00:00| seen| https://gist.github.com/alon710/71d181c729157a76bf49cfdfcfefeae5...

@activepieces/piece-gmail (>=0.12.2, <=0.12.5), @activepieces/piece-sendgrid (>=0.5.3, <=0.5.5) +138 more potentially affected by unknown CVE via nodemailer (>=8.0.0, <=8.0.7)

nodemailer NPM version =8.0.0, =0.12.2, =0.5.3, =0.4.1, =3.19.2, =2.1.108, =0.0.1, =0.0.0-preview.10.8ccd25db, =6.1.196-alpha, =6.1.196-alpha, =6.1.196-alpha, =0.0.1, =0.0.21 and more Source cves: unknown CVE Source advisory: SNYK:JS-NODEMAILER-17342524...

Uncontrolled Recursion

Overview protobufjs is a protocol buffer for JavaScript & TypeScript. Affected versions of this package are vulnerable to Uncontrolled Recursion during the JSON conversion. An attacker can exhaust the call stack and cause the application to crash by supplying crafted protobuf binary data containi...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1128 more potentially affected by CVE-2026-48712 via protobufjs (>=8.0.0, <=8.4.0)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-48712 Source advisory: SNYK:JS-PROTOBUFJS-17353320...

@bnsights-test/test-admin-portal (>=0.0.18, <=0.0.60), @bnsights-test/test-controls (>=0.0.15, <=0.0.55) +13 more potentially affected by CVE-2026-54264 via @angular/service-worker (>=19.0.0, <=19.2.25)

@angular/service-worker NPM version =19.0.0, =0.0.18, =0.0.15, =1.0.0, =1.0.110, =1.2.3, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.0.1, =16.0.0, =1.52.0, =19.0.0, =0.0.27, =0.0.122 Source cves: CVE-2026-54264 Source advisory: OSV:GHSA-QXH6-94W6-9R5P...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) potentially affected by CVE-2026-54264 via @angular/service-worker (>=20.0.0, <=20.3.17)

@angular/service-worker NPM version =20.0.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 Source cves: CVE-2026-54264 Source advisory: OSV:GHSA-QXH6-94W6-9R5P...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +33 more potentially affected by CVE-2026-54268 via @angular/common (>=20.0.0, <=20.3.21)

@angular/common NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.7.3 and more Source cves: CVE-2026-54268 Source advisory: SNYK:JS-ANGULARCOMMON-17356486...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +33 more potentially affected by CVE-2026-54266 via @angular/common (>=20.0.0, <=20.3.21)

@angular/common NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.7.3 and more Source cves: CVE-2026-54266 Source advisory: SNYK:JS-ANGULARCOMMON-17356555...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +43 more potentially affected by CVE-2026-50557 via @angular/core (>=20.0.0, <=20.3.21)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - @getflip/swirl-components-angular 0.472.0-beta-20260406102253 and more Source cves:...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +39 more potentially affected by CVE-2026-50557 via @angular/compiler (>=19.0.0, <=19.2.17)

@angular/compiler NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.346.0, =0.0.1-canary.0.0, =1.0.0-canary.1 - @ismailadekambi/shared 1.0.0 and more Source cves: CVE-2026-50557 Source advisory:...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.201-alpha) +56 more potentially affected by CVE-2026-50557 via @angular/core (>=21.0.0, <=21.2.14)

@angular/core NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =3.0.0 - @koalarx/ui 21.2.4 and more Source cves: CVE-2026-50557 Source advisory: OSV:GHSA-F3M7-GQXR-G87X...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +40 more potentially affected by CVE-2026-50557 via @angular/core (>=19.0.0, <=19.2.20)

@angular/core NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-50557 Source advisory:...

@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +36 more potentially affected by CVE-2026-50557 via @angular/compiler (>=20.0.0, <=20.3.21)

@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =0.0.57, =0.0.60 - @saritasa/renewaire-frontend-sdk 0.1.0-dev.101 and more Source cves: CVE-2026-50557 Source advisory:...