Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium)
Highcharts JS versions prior to 11.4.9, 12.6.1, and 13.1.1 contain a cross-site scripting (XSS) vulnerability. The issue arises because the credits.href property is assigned directly to the window location without validating the URL scheme. An attacker controlling the chart configuration can supply a javascript: URL, which executes script in the context of the hosting page when a user clicks the credits label. This vulnerability affects Highcharts and its related packages Highcharts Stock, Maps, and Gantt. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.1.
CVE-2026-118250 is a prototype pollution vulnerability in Highcharts JS, a JavaScript charting library. Versions from 6.1.0 up to but not including 11.4.9, 12.0.0 up to 12.6.1, and 13.0.0 up to 13.1.0 are affected. The flaw allows an attacker controlling series.keys and point data to manipulate the __proto__ property, assigning arbitrary properties to Object.prototype. This affects all JavaScript on the page without requiring user interaction beyond rendering the chart. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.0.
Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.
Red Hat JBoss Enterprise Application Platform 8.1.9 includes multiple security fixes addressing vulnerabilities in components such as Netty and Apache CXF. These vulnerabilities include information disclosure via CORS header manipulation, denial of service through uncontrolled form parameters and many attachment headers, authentication bypass via crafted OIDC tokens, and XML External Entity (XXE) injection via WSDL/XSD import parsing. The update replaces version 8.1.8 and is rated as having an Important security impact by Red Hat.
CVE-2026-118248 is a prototype pollution vulnerability in Highcharts JS versions from 1.0.0 up to but not including 4.2.2. The issue arises in Highcharts Dashboards edit mode where the editableOptions propertyPath segments do not reject prototype-related keys such as __proto__ or constructor. An attacker controlling editableOptions can exploit this to write values onto Object.prototype, affecting JavaScript behavior throughout the page. This vulnerability is fixed in versions 4.2.2 and 13.1.0.
CVE-2026-118247 is a prototype pollution vulnerability in Highcharts JS affecting versions prior to 13.1.0, Dashboards prior to 4.2.3, and Grid Pro prior to 3.2.0. The issue arises because DataTable single-cell writers use untrusted column IDs without filtering out __proto__ or constructor keys, allowing writes to Object.prototype or the Object constructor. This can alter application control flow or disrupt rendering. Exploitation requires control over table or component column IDs and cell or API writes. The vulnerability is fixed in Highcharts 13.1.0, Dashboards 4.2.3, and Grid Pro 3.2.0.
Highcharts JS versions from 10.0.0 up to but not including 11.4.9, 12.0.0 up to but not including 12.6.1, and 13.0.0 up to but not including 13.1.1 are vulnerable to a cross-site scripting (XSS) issue. The vulnerability arises because Highcharts applies breadcrumbs.style as SVG attributes without filtering attribute names, allowing attackers controlling chart configuration to inject event-handler keys. This leads to execution of malicious scripts in the context of the hosting page when users interact with breadcrumb buttons. Styled-mode charts are not affected. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.1.
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can select a public utility function instead of a supported chart constructor, causing attacker-controlled options to be copied to the container as properties or attributes. Markup and event handlers can then execute in the hosting page origin when the board renders. No user interaction beyond rendering the board is required. This issue is fixed in 4.2.2.
The Field Permissions module for Drupal allows setting field-level permissions including a "Private" setting. A vulnerability exists where "Private" fields on entity types without an author field are not properly restricted, allowing these fields to be viewed and edited by anyone who can view the entity, including anonymous users. This issue requires that an administrator has configured such a field as "Private" on an authorless entity type and that the attacker can already view the entity. Fields on entities with authors and those using custom permissions are not affected. The vulnerability is fixed in version 1.6.0 of the module.
The Drupal OIDC module allows authentication via the OpenID Connect protocol. A vulnerability exists where an attacker can take over any existing Drupal account (except user 1) that has not yet been linked to an OpenID Connect user by logging in with the same email address. This issue is mitigated if the OpenID Connect provider verifies the user's email address. The vulnerability affects versions prior to 2.3.1 and has been fixed in version 2.3.1.
Stage File Proxy is a Drupal module designed to fetch production files on development servers. It is not intended for use on production sites. A vulnerability exists due to insufficient validation of file URLs during fallback retrieval, leading to a cross-site scripting (XSS) vulnerability. Exploitation requires the module to be enabled on the target site and the attacker to have the ability to upload a malicious file to the configured origin server. Fixed versions 3.1.7 and 4.0.1 address this issue.
Highcharts JS versions from 12.0.0 up to but not including 12.6.1, and from 13.0.0 up to but not including 13.1.0, are affected by a cross-site scripting (XSS) vulnerability. This occurs because Highcharts falls back to assigning raw markup to innerHTML when DOMParser fails, before applying its allow-list. In Chromium browsers, this can lead to execution of untrusted HTML event handlers during the beforeprint event when charts are redrawn. The vulnerability affects HTML-rendered titles, labels, data labels, responsive text, and related Highcharts products. The issue is fixed in versions 12.6.1 and 13.1.0.
The OAuth login OAuth2 module for Drupal allows login via OAuth 2.0 or OpenID Connect identity providers. A vulnerability exists due to insufficient access checks on a configuration route and lack of verification that the identity provider has confirmed the email address it returns. This flaw enables an attacker to log in as any existing user if they know that user's email address. Exploitation requires the attacker to have an account with a configured identity provider and control over at least one returned attribute, such as username. The issue is fixed in version 3.1.1.
MIME::Parser versions before 5.521 for Perl have a vulnerability where no limit is set on the number of message parts by default, which can lead to memory exhaustion. The max_parts option defaulted to -1, disabling limits and allowing the parser to build an entity for every part in a message regardless of quantity. Version 5.521 introduces default limits of max_parts to 1000 and max_depth to 64 to mitigate this issue.
CVE-2026-118243 is a prototype pollution vulnerability in Highcharts JS versions from 1.0.0 up to but not including 4.2.2. The issue arises because Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. If an attacker supplies a __proto__ table ID via the dataPool connector configuration, it modifies Object.prototype, creating enumerable properties that affect all objects. This can disrupt features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and enabled component sync, but no user interaction beyond loading the dashboard is needed. The vulnerability is fixed in version 4.2.2.
CVE-2026-105614 is a medium severity vulnerability in DALIBO PostgreSQL Anonymizer versions 1.0.0 up to but not including 3.3.0. The flaw exists in the anon.image_blur() function, which fails to validate the declared dimensions of an input image. An attacker can exploit this by submitting a small image with falsely large declared dimensions, causing excessive memory allocation. This can lead to backend memory exhaustion and out-of-memory (OOM) termination, triggering a cluster-wide crash recovery. The issue is fixed in version 3.3.0 and later.
The Drupal Fasttoggle module contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to change the publication status, promotion, and stickiness of nodes, as well as the publication status of comments. This occurs when a user with the "Use Fasttoggle" permission visits a malicious page while logged in. The vulnerability is mitigated by the requirement that the attacker must trick a user with this specific permission into visiting an attacker-controlled page. A fix is available in version 4.1.1.