vm2 NodeVM can replace the host process TLS trust store

CVE-2026-92941

Summary vm2 3.11.6 exposes the host `tls` module to a `NodeVM` when that builtin is explicitly allowed. Although the mo

历史摘要 · 未重新核验 · GitHub Advisory

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

CVE-2026-92945

## Summary `isPathAllowedForModule` decides whether a resolved path belongs to an allowlisted external module using a r

历史摘要 · 未重新核验 · GitHub Advisory

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

CVE-2026-102830

## Description A language pack ships a `Plural-Forms` header saying how the language counts, for example `nplurals=2; p

历史摘要 · 未重新核验 · GitHub Advisory

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

CVE-2026-102904

JupyterLab's PyPI extension manager runs `python -m pip uninstall` with the extension name taken from the request body.

历史摘要 · 未重新核验 · GitHub Advisory

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

CVE-2026-102831

## Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses cl

历史摘要 · 未重新核验 · GitHub Advisory

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

CVE-2026-89425

## Status **FULLY REPRODUCED.** A malformed token fed through `createParser(DataInput)` produced a 20,000,109-character

历史摘要 · 未重新核验 · GitHub Advisory

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

CVE-2026-89407

## Status **FULLY REPRODUCED** with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for

历史摘要 · 未重新核验 · GitHub Advisory

devalue: `stringify`/`uneval` serialize shared memory

CVE-2026-92708

### Impact `stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view. I

历史摘要 · 未重新核验 · GitHub Advisory

devalue: Residual sparse-array CPU amplification in uneval

`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker

历史摘要 · 未重新核验 · GitHub Advisory

devalue: Repeated primitive strings cause quadratic expansion in uneval

Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into

历史摘要 · 未重新核验 · GitHub Advisory

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Evaluating legitimate `uneval` output for a sparse array can allocate memory proportional to its declared length. A tiny

历史摘要 · 未重新核验 · GitHub Advisory

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promi

历史摘要 · 未重新核验 · GitHub Advisory

rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist

CVE-2026-103687

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the f

历史摘要 · 未重新核验 · OSV.dev

rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting

CVE-2026-103686

A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of t

历史摘要 · 未重新核验 · OSV.dev

Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generation

CVE-2026-103680

A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numb

历史摘要 · 未重新核验 · OSV.dev

Tnef: use-after-free and double-free in get_body_files() via multi-value body extraction

CVE-2026-103679

A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport

历史摘要 · 未重新核验 · OSV.dev

Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value

CVE-2026-103678

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing un

历史摘要 · 未重新核验 · OSV.dev

Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

CVE-2026-88789

Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apa

历史摘要 · 未重新核验 · OSV.dev

Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route

CVE-2026-103758

Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP s

历史摘要 · 未重新核验 · OSV.dev

Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation

CVE-2026-103757

Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUr

历史摘要 · 未重新核验 · OSV.dev