826 matches found
Mermaid configuration APIs allow prototype pollution
Summary Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge the caller-supplied configuration object into Mermaid's internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution. Because these APIs...
SUSE CVE-2026-69198
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...
EUVD-2026-52869
SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...
CLSA-2026-1783040458 TuxCare security update for @angular (11 CVEs)
TuxCare rebuilt 19 @angular packages to address 11 CVEs. Fixed in 10.1.0-tuxcare.3...
CLSA-2026-1781830590 TuxCare security update for glob (1 CVE)
TuxCare rebuilt glob to address 1 CVE. Fixed in 10.2.6-tuxcare.1...
CLSA-2026-1780707089 TuxCare security update for @angular (1 CVE)
TuxCare rebuilt 19 @angular packages to address 1 CVE. Fixed in 10.1.0-tuxcare.1...
CLSA-2026-1779842936 TuxCare security update for laravel/framework (1 CVE)
TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 10.48.28-p1+tuxcare...
CLSA-2026-1776904626 TuxCare security update for pillow (1 CVE)
TuxCare rebuilt pillow to address 1 CVE. Fixed in 10.4.0.post2+tuxcare...
CLSA-2026-1773706627 TuxCare security update for 40 packages (6 CVEs)
TuxCare rebuilt 40 packages to address 6 CVEs. Fixed in 10.1.42-tuxcare.1...
Security Bulletin: Multiple Vulnerabilities in IBM API Connect
Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.11 Vulnerability Details CVEID:CVE-2020-28851 DESCRIPTION: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to...
CVE-2026-52370
A reflected cross-site scripting (XSS) vulnerability exists in the Forum posting function of O2OA v10 . Attackers can exploit this flaw by providing a crafted URL to execute arbitrary Javascript within the context of a victim's browser. No specific exploit details or remediation instructions are ...
CVE-2026-52370
A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...
CVE-2026-52370
A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...
CVE-2026-52370
A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...
CVE-2026-69198
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...
UBUNTU-CVE-2026-69198
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...
CVE-2026-69192
IP-address Address4 in JavaScript is vulnerable prior to 10.3.1 because a leading-zero octet is decoded as decimal, while the host resolver stack decodes as octal. This mismatch causes misclassification of hosts for trust-boundary decisions (e.g., SSRF filtering) since isPrivate(), isLoopback(), ...
CLEANSTART-2026-JF98321 Security fixes in postgresql15 10.1-r0
Package postgresql15 version 10.1-r0 fixes 2 vulnerabilities: CVE-2017-15098, CVE-2017-15099...
CLEANSTART-2026-ZY67243 Security fixes in incubator-kie-kogito-data-index-ephemeral 10.1.0-r1
Package incubator-kie-kogito-data-index-ephemeral version 10.1.0-r1 fixes 43 vulnerabilities: CVE-2025-11965, CVE-2025-11966, CVE-2025-2240, CVE-2025-48924, CVE-2025-49574...