Electron: SameSite cookie restrictions are not applied to windows opened from links

CVE-2026-113796

### Impact Pages opened into a new window from a link were loaded as if the app itself had navigated there rather than

历史摘要 · 未重新核验 · GitHub Advisory

Electron: Pointer lock permission requests can be attributed to the wrong frame

CVE-2026-113798

### Impact For `pointerLock` permission requests made from some cross-origin iframes, `session.setPermissionRequestHandl

历史摘要 · 未重新核验 · GitHub Advisory

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

CVE-2026-113797

### Impact `chrome.tabs.query()` returned each tab's `url` and `title` to extensions that held neither the `tabs` permis

历史摘要 · 未重新核验 · GitHub Advisory

Electron: Frame subscription trusts GPU-supplied frame geometry

CVE-2026-114122

### Impact Frame data received from the GPU process for `webContents.beginFrameSubscription` was not fully validated by

历史摘要 · 未重新核验 · GitHub Advisory

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

CVE-2026-114124

### Impact In offscreen rendering mode on macOS, frame data received from the GPU process was not fully validated by the

历史摘要 · 未重新核验 · GitHub Advisory

Electron: openExternal permission requests can be attributed to the wrong origin

CVE-2026-114121

### Impact Requests to open external protocol URLs could be attributed to a document other than the one that asked for t

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

## Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The

历史摘要 · 未重新核验 · GitHub Advisory

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

CVE-2026-114145

### Summary `create_submodule(name, path, url)` clones a submodule into the repo's own `.git` directory before it reje

历史摘要 · 未重新核验 · GitHub Advisory

fastify is vulnerable to header validation bypass via case-sensitive propertyNames

CVE-2026-107832

### Impact Fastify lowercases header names in a `headers` schema before compilation, because Node.js stores request hea

历史摘要 · 未重新核验 · GitHub Advisory

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

CVE-2026-114142

### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4

历史摘要 · 未重新核验 · GitHub Advisory

toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()

CVE-2026-114141

## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via many array-of-tables (`

历史摘要 · 未重新核验 · GitHub Advisory

toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()

CVE-2026-114143

## Summary `toml.parse()` is vulnerable to a quadratic-complexity (O(n²)) denial-of-service via a single long dotted ke

历史摘要 · 未重新核验 · GitHub Advisory

toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()

CVE-2026-114144

### Summary `toml.parse()` converts integer literals (hex, octal, binary, and decimal) to `BigInt` without first boundin

历史摘要 · 未重新核验 · GitHub Advisory

Storybook dev server vulnerable to code injection from the local network

CVE-2026-114126

**Summary:** The Storybook dev server exposes its WebSocket authentication token to any client that can load its HTML pa

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

CVE-2026-114128

## Summary Astro's JSX and MDX rendering pipeline treated string children of `` and `` elements as trusted HTML. When a

历史摘要 · 未重新核验 · GitHub Advisory

Astro: Arbitrary CSS injection in Astro View Transitions

CVE-2026-114127

### Summary Astro's server-side View Transition CSS generator did not keep string animation properties within their gen

历史摘要 · 未重新核验 · GitHub Advisory

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

CVE-2026-114604

## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql

历史摘要 · 未重新核验 · GitHub Advisory

GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit

CVE-2026-75508

### Summary The parser's `max_tokens` limit — the documented defence against oversized GraphQL documents — did not coun

历史摘要 · 未重新核验 · GitHub Advisory

GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule

CVE-2026-75507

### Summary The `OverlappingFieldsCanBeMerged` validation rule can be driven into quadratic — and in the worst case `O(

历史摘要 · 未重新核验 · GitHub Advisory

DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

## Summary When DOMPurify is configured with `SAFE_FOR_TEMPLATES: true` together with a DOM-returning mode (`RETURN_DOM

历史摘要 · 未重新核验 · GitHub Advisory