21453 matches found
CVE-2026-50159 Mermaid allows CSS injection applying to sibling elements of the diagram
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...
CVE-2026-71437
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...
Improperly Controlled Sequential Memory Allocation
Overview org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the setXAxisRangeData function when configuring an X-Axis wi...
@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.27), @142vip/vuepress (0.0.1-alpha.19) +211 more potentially affected by CVE-2026-71436 via mermaid (>=11.0.0, <=11.16.0)
mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.15.0, =0.35.0, =0.2.0, =1.0.1 and more Source cves: CVE-2026-71436 Source advisory: OSV:GHSA-2V8P-3F2J-5MP7...
CVE-2026-71436 Mermaid XY Charts are vulnerable to an infinite loop DoS
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid...
CVE-2026-66711
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
CVE-2026-66708
Unauthenticated Broken Access Control in Total Upkeep = 1.17.2 versions...
CVE-2026-66439
Unauthenticated Cross Site Scripting XSS in Advanced AJAX Product Filters = 3.2.0.3 versions...
CVE-2026-61959
Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...
UBUNTU-CVE-2026-34501
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...
CVE-2026-66709
The CVE-2026-66709 entry describes a Remote Code Execution (RCE) vulnerability in the WordPress CTX Feed plugin (CTX Feed)
CVE-2026-66703 WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in MailOptin = 1.2.78.0 versions...
CVE-2026-66696 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...
EUVD-2026-53898
Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...
CVE-2026-66665 WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...
CVE-2026-66457 WordPress Events Manager plugin <= 7.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Events Manager = 7.4.1 versions...
CVE-2026-66451
CVE-2026-66451 affects the WordPress plugin WP Event Solution (
CVE-2026-66425 WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...
CVE-2026-66425 WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...