Plate: SSRF with response disclosure in DOCX image embedding

CVE-2026-65842

## Summary `@platejs/docx-io` can fetch remote image URLs while converting HTML to DOCX. When an application converts a

历史摘要 · 未重新核验 · GitHub Advisory

link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

CVE-2026-61704

The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references

CVE-2026-75931

### Impact `fast-uri` canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When `reso

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

CVE-2026-75975

### Impact `fast-uri` does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed liter

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

CVE-2026-75899

### Impact `fast-uri` decodes a hostname's percent escapes twice in a single `normalize()` or `resolve()` call: once du

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

CVE-2026-76172

### Impact `fast-uri` decodes percent-encoded characters in the scheme component with the legacy global `unescape()` an

历史摘要 · 未重新核验 · GitHub Advisory

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

CVE-2026-83610

## Summary An `EntityReference` node can be created with an invalid, attacker-controlled name through `Document.createE

历史摘要 · 未重新核验 · GitHub Advisory

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

CVE-2026-16732

## Impact The fix for [CVE-2026-3635](https://www.cve.org/CVERecord?id=CVE-2026-3635) ([GHSA-444r-cwp2-x5xf](https://gi

历史摘要 · 未重新核验 · GitHub Advisory

ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

CVE-2026-84371

### Summary When SVG animation is allowed, `attributeName="href"` makes `values` a list of URL destinations. `sanitize-h

历史摘要 · 未重新核验 · GitHub Advisory

nanoid: Integer Overflow or Wraparound

CVE-2026-73086

### Summary An integer overflow in `nanoid(size)` permanently corrupts the process-wide CSPRNG pool, causing all subseq

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

## Summary pnpm expands `${VAR}` environment placeholders in the `httpProxy` / `httpsProxy` / `noProxy` settings read f

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

## Summary A crafted lockfile alias could reach several install-time filesystem joins. With `--trust-lockfile` or a fro

历史摘要 · 未重新核验 · GitHub Advisory

Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

CVE-2026-58191

## Summary Appium's base-driver mounts the built-in `/test/guinea-pig`, `/test/guinea-pig-scrollable` and `/test/guinea

历史摘要 · 未重新核验 · GitHub Advisory

Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

CVE-2026-73089

## Vulnerability Details **File**: `index.js` **Location**: `cache` (browserslist()'s result cache, line ~402) and `par

历史摘要 · 未重新核验 · GitHub Advisory

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

CVE-2026-73088

## Vulnerability Details **File**: `node.js` **Function**: `normalizeStats()` (line ~214), reached from `getStat()` (ca

历史摘要 · 未重新核验 · GitHub Advisory

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

## Summary A rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth s

历史摘要 · 未重新核验 · GitHub Advisory

decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

CVE-2026-45822

### Impact An attacker who can supply input to `decodeUriComponent()` (directly or via a dependency that uses this packa

历史摘要 · 未重新核验 · GitHub Advisory

Socket.IO: Engine.IO WebTransport SID DoS

CVE-2026-59724

### Impact Engine.IO servers with **WebTransport enabled** are vulnerable to a remotely triggerable denial of service.

历史摘要 · 未重新核验 · GitHub Advisory

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

CVE-2026-81888

### Summary The built-in social login providers accept an OAuth callback even when the `state` value is absent on both

历史摘要 · 未重新核验 · GitHub Advisory

MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

CVE-2026-55855

### Summary A SQL injection is possible when the connector escapes Buffer parameters client-side under a multi-byte cli

历史摘要 · 未重新核验 · GitHub Advisory