96 matches found
Security Bulletin: Multiple Vulnerabilities in IBM CloudPak System
Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-29074 DESCRIPTION: SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1,...
CLSA-2026-1790520171 TuxCare security update for svgo (1 CVE)
TuxCare rebuilt svgo to address 1 CVE. Fixed in 1.3.2-tuxcare.1...
CLSA-2026-1790176195 TuxCare security update for svgo (1 CVE)
TuxCare rebuilt svgo to address 1 CVE. Fixed in 2.8.0-tuxcare.4...
ROOT-APP-NPM-CVE-2026-73650 CVE-2026-73650 in svgo - Patched by Root
Root has patched CVE-2026-73650 in the svgo package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-84370 CVE-2026-84370 in svgo - Patched by Root
Root has patched CVE-2026-84370 in the svgo package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-858273 AIKIDO-2026-858273 in svgo - Patched by Root
Root has patched AIKIDO-2026-858273 in the svgo package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-2P49-HGCM-8545 GHSA-2p49-hgcm-8545 in svgo - Patched by Root
Root has patched GHSA-2p49-hgcm-8545 in the svgo package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-29074 CVE-2026-29074 in svgo - Patched by Root
Root has patched CVE-2026-29074 in the svgo package for Root:npm. Multiple fixed versions available...
CLSA-2026-1788978264 TuxCare security update for svgo (2 CVEs)
TuxCare rebuilt svgo to address 2 CVEs. Fixed in 2.8.0-tuxcare.3...
CLSA-2026-1788978124 TuxCare security update for svgo (2 CVEs)
TuxCare rebuilt svgo to address 2 CVEs. Fixed in 4.0.2-tuxcare.1...
SVGO: removeScripts allows executable links through namespace and control-character bypasses
Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...
@343dev/optimizt (>=12.0.0, <=13.0.0), @agilebot/vitepress-preset (>=0.8.9, <=0.9.6) +79 more potentially affected by CVE-2026-84370 via svgo (>=4.0.0, <=4.0.2)
svgo NPM version =4.0.0, =12.0.0, =0.8.9, =0.0.8, =0.0.1772240426360, =0.1.0, =1.0.0, =2.47.0, =1.3.0-next.0, =3.0.0-next.0, =6.13.0, =0.0.1769658265953, =21.2.6, =1.6.9, =0.1.0-dev.00e4942, =0.3.0 and more Source cves: CVE-2026-84370 Source advisory: OSV:GHSA-W27V-7Q3P-W38R...
5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +246 more potentially affected by CVE-2026-84370 via svgo (>=3.0.0, <=3.3.3)
svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-84370 Source advisory: OSV:GHSA-W27V-7Q3P-W38R...
-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +45457 more potentially affected by CVE-2026-84370 via svgo (>=1.0.0, <=2.8.0)
svgo NPM version =1.0.0, =1.0.1, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 and more Source cves: CVE-2026-84370 Source...
EUVD-2026-69653
SVGO: removeScripts allows executable links through namespace and control-character bypasses...
NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses
NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...
GHSA-W27V-7Q3P-W38R SVGO: removeScripts allows executable links through namespace and control-character bypasses
Summary SVGO's opt-in removeScripts plugin failed to remove some executable links. Namespace-prefixed SVG anchors and URL schemes containing ASCII tabs or newlines could bypass its checks. Applications that used this plugin as their only protection for untrusted SVG input could expose users to...
GHSA-4VPR-X523-8J87 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
Summary SVGO's opt-in removeScripts plugin did not inspect executable HTML content inside SVG elements. Applications that used this plugin as their only protection for untrusted SVG input could produce SVGs containing active HTML and expose users to cross-site scripting XSS. SVGO is an optimizer...
-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +45457 more potentially affected by CVE-2026-84369 via svgo (>=1.0.0, <=2.8.0)
svgo NPM version =1.0.0, =1.0.1, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 and more Source cves: CVE-2026-84369 Source...