115760 matches found
@nx/powerpack-azure-cache (>=5.0.0, <=5.0.7) potentially affected by CVE-2026-71476 via @nx/azure-cache (>=5.0.0, <=5.0.7)
@nx/azure-cache NPM version =5.0.0, =5.0.0, =5.0.7 Source cves: CVE-2026-71476 Source advisory: OSV:GHSA-VP3H-GHGH-JR7G...
@10xsai/cloudflare-router-nx-plugin (1.0.0), @abelfubu/schematics (0.1.1) +345 more potentially affected by CVE-2026-71476 via nx (>=20.8.0, <=22.7.6)
nx NPM version =20.8.0, =0.0.17, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =8.1.1, =11.0.0, =0.1.1, =0.0.1, =2.23.0, =2.32.0 and more Source cves: CVE-2026-71476 Source advisory: OSV:GHSA-VP3H-GHGH-JR7G...
CVE-2026-71476 Nx: Zip-Slip in the self-hosted remote cache
Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path MITM remote cache server can return a crafted...
CVE-2026-71439 Mermaid radar diagrams are vulnerable to DoS
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript...
CVE-2026-71439 Mermaid radar diagrams are vulnerable to DoS
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze the rendering webpage or JavaScript...
CVE-2026-15734 WGDashboard Server-Side Template Injection vulnerability
A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...
CVE-2026-15734 WGDashboard Server-Side Template Injection vulnerability
A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...
@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.29), @142vip/vuepress (0.0.1-alpha.19) +211 more potentially affected by CVE-2026-71438 via mermaid (>=11.0.0, <=11.16.0)
mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.15.0, =0.35.0, =0.2.0, =1.0.1 and more Source cves: CVE-2026-71438 Source advisory: SNYK:JS-MERMAID-18592324...
@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +243 more potentially affected by CVE-2026-71438 via mermaid (>=10.0.0, <=10.9.5)
mermaid NPM version =10.0.0, =0.18.0-beta.0, =0.17.0-alkemio-1, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.17.1, =0.0.19, =0.0.1, =0.0.1, =0.0.6 and more Source cves: CVE-2026-71438 Source advisory: SNYK:JS-MERMAID-18592324...
@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.29), @142vip/vuepress (0.0.1-alpha.19) +211 more potentially affected by CVE-2026-50159 via mermaid (>=11.0.0, <=11.16.0)
mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.15.0, =0.35.0, =0.2.0, =1.0.1 and more Source cves: CVE-2026-50159 Source advisory: SNYK:JS-MERMAID-18592305...
CVE-2026-50159 Mermaid allows CSS injection applying to sibling elements of the diagram
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...
EUVD-2026-54243
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...
CVE-2026-71437
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...
@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +201 more potentially affected by CVE-2026-71436 via mermaid (>=10.6.1, <=10.9.5)
mermaid NPM version =10.6.1, =0.18.0-beta.0, =0.17.1-alkemio-5, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.0.1, =0.0.1, =7.1.0, =0.114.3, =0.141.3 and more Source cves: CVE-2026-71436 Source advisory: OSV:GHSA-2V8P-3F2J-5MP7...
Improperly Controlled Sequential Memory Allocation
Overview org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the setXAxisRangeData function when configuring an X-Axis wi...
@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.29), @142vip/vuepress (0.0.1-alpha.19) +211 more potentially affected by CVE-2026-71436 via mermaid (>=11.0.0, <=11.16.0)
mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.15.0, =0.35.0, =0.2.0, =1.0.1 and more Source cves: CVE-2026-71436 Source advisory: OSV:GHSA-2V8P-3F2J-5MP7...
CVE-2026-71436 Mermaid XY Charts are vulnerable to an infinite loop DoS
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid...
CVE-2026-64654 GitHub CLI: Terminal escape sequence injection in multiple `gh` commands
GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...
@cmmv/ai (0.0.5), @graphql-mesh/neo4j (>=0.103.0, <=0.106.2) +2 more potentially affected by CVE-2026-5423 via @neo4j/graphql (6.6.4)
@neo4j/graphql NPM version 6.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on @neo4j/graphql and may be impacted: - @cmmv/ai 0.0.5 - @graphql-mesh/neo4j =0.103.0, =0.7.13-alpha-20241031110808-e6f493d3529c46de0c7c0358ed1e2b5942f2a2a2, =0.7.0, =0.10.2...
