ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes that are not passed through schema attribute validation. When a user pastes the crafted HTML into an editor, the unvalidated context attributes can construct content that executes attacker-controlled JavaScript in the browser window containing the editor. This issue is fixed in version 1.42.3.
CVE-2026-104846 is a critical type confusion vulnerability in the lxsmnsyc seroval library affecting versions from 0.12.0 up to but not including 1.6.2. The flaw allows attacker-controlled JSON to trigger unexpected code execution via deserialization of a fulfilled Promise control node, bypassing previous remediation attempts. This issue is fixed in version 1.6.2.
CVE-2026-101104 is an authorization vulnerability in the Meari IoT Cloud Platform OpenAPI Service. Authenticated users can manipulate device configurations for devices they do not own due to missing authorization checks. This flaw allows unauthorized changes to device settings or triggering unintended device behaviors without verifying user permissions. The vulnerability has a CVSS 4.0 score of 6.3, indicating medium severity. No affected versions or patch information are provided. There are no known exploits in the wild at this time.
CVE-2026-104845 is a high-severity vulnerability in the seroval library prior to version 1.6.3. It involves unbounded allocation of resources during deserialization of TypedArrays from untrusted JSON input, which can lead to CPU or memory exhaustion and event loop starvation. The flaw does not impact confidentiality or integrity. The issue is fixed in seroval version 1.6.3.
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.
GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.
A vulnerability in the Smart One Click Setup – Complete Demo Import & Export plugin (up to version 1.4.3) allows insertion of sensitive information into sent data. This issue could lead to unintended disclosure of embedded sensitive data. The vulnerability has a CVSS 3.1 score of 5.3 (medium severity) and does not require user interaction or privileges to exploit.
A missing authorization vulnerability exists in ThimPress LearnPress up to version 4.4.9.1. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to integrity issues. The vulnerability does not affect confidentiality or availability. It has a CVSS score of 4.3, indicating medium severity.
A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation of the argument ID leads to improper authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-39444 is an authorization bypass vulnerability in PublishPress Series up to version 3.1.3. It involves exploitation of incorrectly configured access control security levels via a user-controlled key. This flaw allows an attacker with limited privileges to bypass authorization checks, potentially leading to limited integrity and availability impacts. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation information is currently available.
A missing authorization vulnerability in Kiera Howe WebSamurai allows exploitation of incorrectly configured access control security levels. This affects WebSamurai versions up to and including 1.0.7. The vulnerability can lead to unauthorized modification of data without impacting confidentiality or availability. It has a medium severity rating with a CVSS score of 6.5.
CodeAstro Simple Pharmacy Management System 1.0 contains a SQL injection vulnerability in the /SimplePharmacy-PHP/product/view.php file. This vulnerability is caused by improper handling of the ID argument, allowing remote attackers with low privileges to manipulate SQL queries. The vulnerability has a CVSS score of 6.3, indicating a medium severity impact on confidentiality, integrity, and availability. The exploit has been publicly disclosed but is not known to be actively exploited in the wild. No patch or remediation information is currently available.
CodeAstro Simple Pharmacy Management System 1.0 contains a SQL injection vulnerability in the /SimplePharmacy-PHP/product/delete.php file due to improper handling of the ID argument. This vulnerability allows remote attackers with low privileges to manipulate SQL queries. An exploit is publicly available. The CVSS score is 6.3, indicating a medium severity impact on confidentiality, integrity, and availability.
A stack-based buffer overflow vulnerability exists in the POST request handler component of Tenda AC9 firmware version 15.03.02.13, specifically in the /goform/fast_setting_internet_set file when manipulating the netWanType argument. This vulnerability can be exploited remotely and has a high severity score of 9.1. Public exploit code is available, increasing the risk of exploitation. No patch or remediation information is currently provided.
A critical security vulnerability (CVE-2026-104610) affects the Boa Web Server component in Tenda HG7, HG9, and HG10 devices. The flaw exists in the boaGetVar function within /boaform/formLoopBack, where manipulation of the Ethtype argument can cause a stack-based buffer overflow. This vulnerability is remotely exploitable without authentication and has a maximum CVSS score of 10. The exploit has been publicly disclosed, but there are no confirmed reports of active exploitation in the wild. No patch or remediation information is currently available.
A stored cross-site scripting (XSS) vulnerability exists in ThemeREX Group ThemeREX Addons (trx_addons) affecting versions up to 2.46.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.
A Server-Side Request Forgery (SSRF) vulnerability exists in ThemeREX Group's ThemeREX Addons plugin (trx_addons) affecting versions up to 2.46.0. This vulnerability allows an attacker with low privileges to induce the server to make unauthorized requests, potentially leading to partial confidentiality and integrity impacts without affecting availability. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level.
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. This issue is fixed in version 0.12.18.
Next.js versions from 15.0.0 up to but not including 15.5.27, and from 16.0.0 up to but not including 16.3.8, contain a vulnerability where a shared response cache key is insufficiently scoped. This allows an unauthenticated attacker to poison the cache via a crafted request, potentially causing cross-user content substitution or persistent denial of service until the cache entry is refreshed. The issue is fixed in versions 15.5.27 and 16.3.8.
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.