Page 17
CVE-2026-67213 is a high-severity Denial of Service vulnerability in the nanoid library (versions before 3.3.18 and 5.1.6) where a crafted input to the custom alphabet ID generation function triggers an infinite loop, freezing the Node.js process. The vulnerability was present in the `remotion-composer` package's dependency tree via `package-lock.json`, and was resolved by upgrading nanoid to 3.3.18 and adding a `package.json` override to enforce the patched version across the entire dependency
CVE-2026-67213 is a high-severity Denial of Service vulnerability in the popular nanoid library where a crafted call to the custom alphabet ID generation function can trigger an infinite loop, hanging the Node.js process indefinitely. The fix upgrades nanoid from 3.3.17 to 3.3.18 (and from pre-5.1.6 to 5.1.6) in `src-frontend/package-lock.json`, eliminating the infinite loop condition. Any application using nanoid's custom alphabet feature with user-influenced input was potentially exposed to a
CVE-2026-31938 is a critical cross-site scripting vulnerability in jsPDF versions prior to 4.2.1, where unsanitized output options could allow attackers to inject malicious scripts into PDF generation workflows. The fix upgrades jsPDF from 3.0.4 to 4.2.1 in both `package.json` and `pnpm-lock.yaml`, closing the attack surface in Handsontable's export-to-PDF feature. Developers using jsPDF in any web application should upgrade immediately, as this vulnerability is assessed as likely exploitable.
CVE-2026-42151 is a high-severity information disclosure vulnerability in the Prometheus monitoring library (github.com/prometheus/prometheus) that exposed Azure OAuth client secrets through the Prometheus configuration API endpoint. Applications depending on versions prior to v0.311.3 were at risk of leaking sensitive Azure credentials to anyone with access to the config API. The fix involves upgrading the dependency in go.mod from v0.310.0 to v0.311.3.
CVE-2026-67213 is a high-severity Denial of Service vulnerability in the popular nanoid package, where a flaw in the custom alphabet random ID generation path can trigger an infinite loop, hanging the process indefinitely. The fix upgrades nanoid from 3.3.12 to 3.3.18 (and 5.x to 5.1.6), patching the loop condition without changing any public API behavior. Any web application that exposes nanoid's ID generation to user-influenced input should treat this as a priority update.
A high-severity Expression Language (EL) injection vulnerability was discovered and fixed in `PrimeFacesResourceProcessor.java`, a JSF phase listener responsible for resolving the PrimeFaces theme configuration. The flaw allowed a dynamically sourced theme parameter value to be passed directly into an EL expression factory without first verifying whether the value was actually an EL expression or plain text. The fix introduces explicit input branching that separates EL expressions from literal s
CVE-2026-69185 is a high-severity Denial of Service vulnerability in `socket.io-parser` where crafted malicious packets can exhaust server memory, crashing real-time Node.js applications. The fix upgrades `socket.io-parser` from version 4.2.6 to 4.2.7 and pins the dependency via an `overrides` field in `package.json` to ensure the patched version is used throughout the dependency tree. Any application using Socket.IO for bidirectional real-time communication is potentially at risk until this upg
A medium-severity XML External Entity (XXE) vulnerability was discovered in `listKeyboardLayouts.py`, where Python's native `xml.etree.ElementTree` library was used to parse XML data. This library is susceptible to XXE attacks, which can allow attackers to read local files, perform server-side request forgery, or cause denial of service. The fix replaces the unsafe import with `defusedxml.ElementTree`, a drop-in hardened alternative recommended by the Python documentation itself.
A Denial of Service vulnerability (CVE-2026-32285) was discovered in the `github.com/buger/jsonparser` dependency used by this Go application, where crafted malformed JSON input could cause the parser to crash or hang, potentially taking down any service that processes untrusted JSON. The fix upgrades the dependency from v1.1.1 to v1.1.2 in `go.mod` and `go.sum`, closing the attack vector without changing any valid-input behavior. This is a practical reminder that transitive dependencies carry r
A high-severity vulnerability in `golang.org/x/mod` (CVE-2026-56864) allowed a malicious GOSUMDB to serve arbitrary module content by exploiting weaknesses in checksum database verification. Upgrading from v0.37.0 to v0.40.0 closes the attack surface by tightening how the module system validates responses from untrusted sources. Any Go project that resolves dependencies through a compromised or attacker-controlled proxy is affected until this upgrade is applied.
A high-severity prototype pollution vulnerability (CVE-2021-43138) was discovered in the `async` npm package versions prior to 3.2.2, affecting the `node-red-contrib-opcua` project. By exploiting crafted input passed through async's utility functions, an attacker could corrupt JavaScript's `Object.prototype`, potentially enabling privilege escalation or remote code execution. Upgrading `async` from `3.2.1` to `^3.2.2` in both `package.json` and `package-lock.json` eliminates the attack surface e
A high-severity SQL injection vulnerability was discovered in a BigQuery connector's query-building logic, where Python f-strings interpolated user-controlled identifiers—project_id, dataset_id, table_id, and timestamp_column—directly into SQL without validation. An attacker with control over connector configuration could inject arbitrary BigQuery SQL, including destructive statements. The fix introduces strict allowlist-based identifier validation using compiled regular expressions before any S