EUVD-2026-68402

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

PT-2026-83744

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

CVE-2026-32274

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which...

PT-2026-25073

Name of the Vulnerable Software and Affected Versions Black versions prior to 26.3.1 Description Black, a Python code formatter, prior to version 26.3.1, improperly sanitizes user-supplied input when constructing the filename for a cache file. Specifically, the value provided to the...

Mikaelbr Node-notifier Operating System Command Injection Vulnerability

Mikaelbr Node-notifier is a Javascript-based codebase for sending rulers for Mac, Windows, and Linux by the individual developer Mikaelbr. A security vulnerability exists in node-notifier versions prior to 9.0.0, which allows an attacker to exploit the vulnerability to run arbitrary commands on a...