tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape

CVE-2026-44705

### Summary The tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary dir

历史摘要 · 未重新核验 · GitHub Advisory

LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`

CVE-2026-44646

## Summary `Context.spawn()` in liquidjs creates a child `Context` for the `{% render %}` tag but does not propagate th

历史摘要 · 未重新核验 · GitHub Advisory

LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

CVE-2026-44645

## Summary The `renderLimit` option — documented in `docs/source/tutorials/dos.md` as the mechanism that "mitigates thi

历史摘要 · 未重新核验 · GitHub Advisory

LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

CVE-2026-44644

## Summary The `strip_html` filter in liquidjs is intended to remove HTML tags from a string before rendering, and is w

历史摘要 · 未重新核验 · GitHub Advisory

FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

CVE-2026-43947

### Summary An unauthenticated Remote Code Execution vulnerability exists in FUXA when `secureEnabled` is set to `true`

历史摘要 · 未重新核验 · GitHub Advisory

FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

CVE-2026-43946

### Summary An authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when t

历史摘要 · 未重新核验 · GitHub Advisory

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

CVE-2026-43945

**Pre-auth** RCE in FUXA via Logic Bypass Summary A Critical vulnerability chain exists in FUXA (v.1.3.0-2706) that al

历史摘要 · 未重新核验 · GitHub Advisory

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

CVE-2026-42462

### Summary An attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify

历史摘要 · 未重新核验 · GitHub Advisory

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

CVE-2026-42089

### Impact `yeoman-environment` versions `>= 2.9.0` and `< 6.0.1` install missing local generator packages from caller-

历史摘要 · 未重新核验 · GitHub Advisory

CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS

CVE-2026-26028

### Summary CryptPad’s HTML sanitizer in Diffmarked.js can be bypassed due to incomplete filtering of restricted tags. B

历史摘要 · 未重新核验 · GitHub Advisory

Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers

CVE-2026-39964

### Summary The Typebot viewer (`packages/embeds/js`) renders anchor tags from rich text bubble content without filteri

历史摘要 · 未重新核验 · GitHub Advisory

Parse Server: Pre-authentication denial of service via client version header regex backtracking

CVE-2026-47138

### Impact An unauthenticated attacker who knows a publicly-known Parse Application ID can submit a single HTTP request

历史摘要 · 未重新核验 · GitHub Advisory

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

CVE-2026-8723

### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on a

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

CVE-2026-46701

# Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret | Field | Value | | ------------

历史摘要 · 未重新核验 · GitHub Advisory

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

CVE-2026-46703

#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI

历史摘要 · 未重新核验 · GitHub Advisory

BoxLite: Permission Bypass Allows Modification of Read-Only Files

CVE-2026-46695

#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch O

历史摘要 · 未重新核验 · GitHub Advisory

@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

CVE-2026-46681

## Summary The _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties wit

历史摘要 · 未重新核验 · GitHub Advisory

js-libp2p: Memory DoS via subscription flood of unique topics

CVE-2026-46679

### Summary Three cooperating omissions in `@libp2p/gossipsub` allow an unauthenticated single peer to exhaust the Node.

历史摘要 · 未重新核验 · GitHub Advisory

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

CVE-2026-46625

## Summary `js-cookie`'s internal `assign()` helper copies properties with `for...in` + plain assignment. When the sour

历史摘要 · 未重新核验 · GitHub Advisory

@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails

Impact: @hulumi/policies versions before 1.3.2 used stack-wide evidence shortcuts in several Cloudflare and deployment-g

历史摘要 · 未重新核验 · GitHub Advisory