Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package introduced through a trusted package's packageGroup can supply .. segments or an absolute path, causing nx migrate to join an escaping destination onto its temporary directory. The migration archive can then write attacker-controlled bytes outside the temporary directory, while opening the destination stream can truncate an existing writable file even when no archive entry matches. This occurs during migration planning before review of the migration list or use of --run-migrations; the vulnerable installed Nx copy is reached when the normal nx@latest handoff is bypassed with NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or fallback after a temporary-install failure. This issue is fixed in versions 22.7.10 and 23.2.1.
CVE-2026-104851 is a high-severity code injection vulnerability in the fsspec filesystem_spec Python library. Versions from 0.9.0 up to but not including 2026.6.0 allow attacker-controlled Kerchunk reference JSON documents to execute arbitrary Python code via unsafe jinja2 template rendering when opening the reference filesystem. This can occur before any referenced data is read and affects multiple code paths depending on document content and options. The issue is fixed in version 2026.6.0.
GitLab warned customers today to immediately patch a critical AI Gateway vulnerability that could let attackers run arbitrary commands on vulnerable instances. [...]
Tinypool versions prior to 2.1.2 contain a code injection vulnerability due to improper handling of the filename property in the options object passed to pool.run(). An attacker who can pollute Object.prototype.filename can cause the worker pool to load malicious JavaScript code, potentially leading to arbitrary code execution with the host process's privileges. This vulnerability is fixed in version 2.1.2.
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own properties and passed to worker_threads.Worker. An attacker who can first pollute either property can cause each newly spawned worker to load attacker-selected JavaScript through command-line preload arguments or NODE_OPTIONS, resulting in code execution with the host process's privileges and possible access to CI secrets, signing material, or build artifacts. This issue is fixed in version 2.1.1.
The rmcp OAuth client in the modelcontextprotocol rust-sdk accepts a server-controlled resource_metadata URL from the WWW-Authenticate header and fetches it without validating origin or blocking internal network addresses. This allows an attacker-controlled or compromised MCP server to induce the client to make HTTP requests to internal or cloud metadata endpoints, potentially exposing sensitive internal resources. The vulnerability is classified as SSRF with medium severity, depending on the network context of the embedding application. A patch is available to enforce same-origin checks and block private network addresses.
CVE-2026-103627 is an information leak vulnerability in the SVG component of Google Chrome prior to version 154.0.8037.97. It allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5. A fix is available in Chrome version 154.0.8037.97.
A buffer overflow vulnerability exists in the WebRTC component of Google Chrome prior to version 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code within the browser's sandbox by delivering a specially crafted HTML page. The vulnerability is rated as high severity with a CVSS score of 8.8.
A use-after-free vulnerability exists in the MediaStream component of Google Chrome prior to version 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.8. Google has released an update to address this issue.
A use-after-free vulnerability in the SVG component of Google Chrome prior to version 154.0.8037.97 allows a remote attacker to execute arbitrary code within the sandbox via a crafted HTML page. This vulnerability is rated high severity with a CVSS score of 8.8.
An integer overflow vulnerability in the Skia component of Google Chrome prior to version 154.0.8037.97 allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 4.3. A stable channel update addressing this issue has been released by Google.
CVE-2026-103624 is a use-after-free vulnerability in the Contextual Tasks component of Google Chrome on Windows. It affects versions prior to 154.0.8037.97 and allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The vulnerability has a high severity rating with a CVSS score of 8.3.
A type confusion vulnerability in the V8 JavaScript engine of Google Chrome prior to version 154.0.8037.97 allows remote attackers to execute arbitrary code within the browser sandbox via a crafted HTML page. This vulnerability has a high severity rating and affects versions before the specified fixed release.
CVE-2026-103630 is a use-after-free vulnerability in the FedCM component of Google Chrome prior to version 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a critical severity with a CVSS score of 9.6. Google has released a stable channel update to address this issue.
An integer overflow vulnerability in the compositing component of Google Chrome prior to version 154.0.8037.97 allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 4.3. This issue was addressed in Chrome version 154.0.8037.97.
A critical security vulnerability (CVE-2026-103626) exists in Google Chrome on Windows prior to version 154.0.8037.97. The flaw involves incorrect authorization in the FileSystem component, which could allow a remote attacker to execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page. This vulnerability has a high CVSS score of 9.6 and affects versions before 154.0.8037.97.
CVE-2026-103628 is a critical out-of-bounds write vulnerability in the WebGL component of Google Chrome prior to version 154.0.8037.97. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. Google has released an official fix in Chrome version 154.0.8037.97.
CVE-2026-103648 is a critical path traversal vulnerability in demsking image-downloader version 4.3.0 and earlier. It allows an attacker who can control the download URL to write downloaded data outside the intended destination directory, potentially leading to arbitrary file overwrite. This vulnerability has a high CVSS score of 9.1, indicating severe impact on integrity and availability without requiring privileges or user interaction.
SConnect, a popular browser extension and native host used for authentication with eIDs, 3SKeys, and hardware signing tokens, contains a remote code execution (RCE) vulnerability. The flaw arises from a flawed RSA-2048 token validation implementation that allows uninitialized memory to be exploited, enabling arbitrary DLLs to be loaded silently by any site or iframe the user visits. Version 2.16.0.0 of the extension and native host is affected. The vulnerability is tracked as CVE-2026-18397 with a CVSS score of 9.4, indicating critical severity.
CVE-2026-96613 is an authorization vulnerability in the Meari IoT Cloud Platform OpenAPI Service. Authenticated users can access the full device shadow of any device by specifying its device ID without proper authorization checks. This flaw exposes sensitive data including device credentials, owner information, network details, and telemetry data. The vulnerability has a high severity rating with a CVSS score of 7.1. No affected versions or patch information are currently provided.