eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields

CVE-2026-44214

### Summary `eventsource-encoder` does not sanitize the `event` or `id` fields of an `EventSourceMessage` before serial

历史摘要 · 未重新核验 · GitHub Advisory

Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

CVE-2026-44211

## Summary The `kanban` npm package (used by the `cline` CLI) starts a WebSocket server on `127.0.0.1:3484` with no Ori

历史摘要 · 未重新核验 · GitHub Advisory

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input

CVE-2026-44728

### Impact Using Babel to compile code that was specifically crafted by an attacker can cause Babel to generate output

历史摘要 · 未重新核验 · GitHub Advisory

@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry

# Docker registry auth substring match forwards credentials to a different registry ## Repository `cdxgen/cdxgen` ##

历史摘要 · 未重新核验 · GitHub Advisory

MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys

CVE-2026-44680

## Summary MikroORM's identifier-quoting helper (`Platform.quoteIdentifier` and the postgres/mssql overrides) and its J

历史摘要 · 未重新核验 · GitHub Advisory

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

CVE-2026-6322

### Impact `fast-uri` v3.1.1 and earlier decodes percent-encoded authority delimiters (`%40` as `@`, `%3A` as `:`) insi

历史摘要 · 未重新核验 · GitHub Advisory

open-webui Vulnerable to Stored XSS via Model Description

CVE-2026-44721

> [!IMPORTANT] > Relationship to CVE-2024-7990 > CVE-2024-7990 (issued by huntr.dev, March 2025) describes a stored XS

历史摘要 · 未重新核验 · GitHub Advisory

Electerm users can run dangrous code through link or command line

CVE-2026-43944

### Impact _Arbitrary local code execution via deep links, CLI `--opts`, or crafted shortcuts. Affected users: electerm

历史摘要 · 未重新核验 · GitHub Advisory

Electerm Security Vulnerability: RCE via malicious SSH server filename in openFileWithEditor

CVE-2026-43943

### Impact A code execution (RCE) vulnerability exists in electerm's SFTP open with system editor or "Edit with custom

历史摘要 · 未重新核验 · GitHub Advisory

Electerm's full process.env exposed to renderer via window.pre.env

CVE-2026-43942

### Impact The `getConstants()` IPC handler in `src/app/lib/ipc-sync.js` serialises the entire `process.env` object and

历史摘要 · 未重新核验 · GitHub Advisory

Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click

CVE-2026-43941

### Impact Electerm's terminal hyperlink handler passes any URL clicked in the terminal directly to `shell.openExternal

历史摘要 · 未重新核验 · GitHub Advisory

Electerm runWidget has a path traversal that leads to arbitrary code execution

CVE-2026-43940

### Impact The `runWidget` function in `src/app/widgets/load-widget.js` constructs a file path by directly concatenating

历史摘要 · 未重新核验 · GitHub Advisory

mcp-ssh-tool has file transfer path policy bypass and bearer token comparison hardening

## Summary `mcp-ssh-tool` has released version `2.1.1` with security hardening for transfer path authorization and HTTP

历史摘要 · 未重新核验 · GitHub Advisory

nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)

CVE-2026-44589

## Summary The `isBlockedUrl()` denylist introduced in `nuxt-og-image@6.2.5` to remediate **GHSA-pqhr-mp3f-hrpp** (Dmit

历史摘要 · 未重新核验 · GitHub Advisory

Compromised version of intercom-client published to npm

### Impact On April 30, 2026, version 7.0.4 of intercom-client was published to npm using credentials obtained from a c

历史摘要 · 未重新核验 · GitHub Advisory

Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker

CVE-2026-42553

### Impact A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes (fo

历史摘要 · 未重新核验 · GitHub Advisory

vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary

CVE-2026-44000

### Summary A sandbox boundary violation in **vm2** allows host object identity to cross into the sandbox through host

历史摘要 · 未重新核验 · GitHub Advisory

vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion

CVE-2026-44004

### Summary Sandboxed code can call `Buffer.alloc()` with an arbitrary size to allocate memory directly on the host heap

历史摘要 · 未重新核验 · GitHub Advisory

vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)

CVE-2026-44001

### Summary A sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process vi

历史摘要 · 未重新核验 · GitHub Advisory

vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape

CVE-2026-43999

## Summary NodeVM's `builtin` allowlist can be bypassed when the `module` builtin is allowed (including via the `'*'` wi

历史摘要 · 未重新核验 · GitHub Advisory