Threats affecting pkg:generic/mongoose

MQTTX desktop versions up to 1.13.3 have a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious scripts via MQTT topic names or payloads that are rendered without proper escaping in tooltips. When a user hovers over affected Topic Tree or JSON tree nodes, the malicious script executes in the Electron renderer environment, which has nodeIntegration enabled, increasing potential impact.

The npm package rex-react-diag-tools-v1 contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.

Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages affecting Red Hat Enterprise Linux 9.4 and related variants. The update addresses a range of issues including out-of-bounds reads and writes, denial of service, privilege requirements, and memory disclosure across various kernel subsystems such as netfilter, Bluetooth RFCOMM, IP tunnels, NVMe TCP, libceph, and others. These vulnerabilities have been assigned CVE identifiers and are rated with an overall security impact of Important. The advisory recommends applying the update and rebooting the system to mitigate these issues.

A heap out-of-bounds write vulnerability exists in Microsoft.DiaSymReader.Native on Windows platforms when reading crafted native PDB files. This affects multiple .NET runtime versions on Windows x86, x64, and Arm64 architectures. The flaw is due to crafted PDB line metadata exceeding the caller-provided buffer. Microsoft has released patches for affected .NET runtime and SDK versions to address this issue.

A high-severity vulnerability exists in Microsoft .NET on Windows platforms affecting multiple architectures (x86, x64, Arm64). The flaw involves attacker-controlled COFF relocation offsets causing an out-of-bounds stack write in the DiaObjectFile::ApplyFixup function. This vulnerability affects various .NET runtime and SDK versions prior to specific patched releases. Updating to the listed fixed versions mitigates the issue.

CVE-2026-97045 is a medium severity vulnerability affecting multiple versions of the external-dns package. The issue involves the function childTextNodesAreLiteral, where tree traversal incorrectly stopped at the nearest foreign ancestor upon encountering an HTML integration point. This flaw could lead to partial compromise of confidentiality and integrity without affecting availability. Multiple affected versions have been identified and fixed in subsequent releases.

CVE-2026-78661 is a high-severity vulnerability affecting multiple versions of the external-dns package. It involves improper handling when coalescing adjacent text nodes in the addText and fosterParent functions, specifically through appending to an existing TextNode's Data via string concatenation. This flaw can lead to a confidentiality impact without affecting integrity or availability. Multiple versions prior to fixed releases are affected, and patches are available.

A security vulnerability in the argo-workflows package involves the Serialize JavaScript component, which serializes JavaScript values to a superset of JSON including regular expressions and functions. This flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a low severity score and does not involve confidentiality, integrity, or availability impacts. A patch is available in versions 4.1.6-r1 and 4.0.15-r2.

A security vulnerability in the argo-workflows package involves a user-configured proxy on webpack-dev-server with a broad context. This issue affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has a CVSS score of 4.3, indicating medium severity, and results in availability impact without compromising confidentiality or integrity.

A high-severity security vulnerability (CVE-2026-93752) affects the argo-workflows package versions prior to 4.0.15-r2. The vulnerability is identified as CSSOM through 0 and has an impact on availability. A fix is available in version 4.0.15-r2.

A security vulnerability exists in the argo-workflows package affecting versions prior to 4.0.15-r2 due to an issue in the uri-js dependency. The flaw has a CVSS 3.1 base score of 6.5, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and impacts confidentiality and integrity. A fix is available in version 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-93749) affects the argo-workflows package due to an issue in the source-map-js dependency through version 1. The vulnerability impacts availability but does not affect confidentiality or integrity. Fixed versions 4.1.6-r1 and 4.0.15-r2 of argo-workflows address this issue.

A high-severity security vulnerability (CVE-2026-93690) affects the argo-workflows package due to an issue in the uri-js dependency through version 4. This vulnerability impacts availability without affecting confidentiality or integrity. A fix is available in version 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-93687) affects the argo-workflows package versions prior to 4.0.15-r2. The flaw does not impact confidentiality or integrity but causes a significant availability impact. A patch is available in version 4.0.15-r2 to address this issue.

A high-severity security vulnerability exists in the argo-workflows package where the shell-quote library's quote() function fails to properly validate object-token inputs against the operator model used by the parse() function. This flaw affects versions prior to 4.1.6-r1 and 4.0.15-r2. The vulnerability has been assigned CVE-2026-9277 and has a CVSS score of 8.1, indicating a significant risk. Fixed versions 4.1.6-r1 and 4.0.15-r2 have been released to address this issue.

A critical security vulnerability (CVE-2026-90711) affects the argo-workflows package due to an issue with the proxy-addr component in Node.js. The flaw allows for network-based exploitation without requiring privileges or user interaction, resulting in high confidentiality and integrity impact. Fixed versions 4.1.6-r1 and 4.0.15-r2 address this vulnerability.

A high-severity security vulnerability (CVE-2026-87776) affects the argo-workflows package in versions prior to 4.1.6-r1 and 4.0.15-r2. The issue involves the compression component being identified as a Node, leading to an impact on availability. The vulnerability has a CVSS score of 7.5 and has been fixed in versions 4.1.6-r1 and 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-85393) affects the argo-workflows package due to an issue in the node-forge dependency through version 1. Versions of argo-workflows prior to 4.0.15-r2 are impacted. The vulnerability allows for integrity impact without confidentiality or availability loss. A patch is available in version 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-84375) affects the argo-workflows package due to an issue in js-yaml, a JavaScript YAML parser and dumper. The vulnerability impacts availability and has been addressed in versions 4.1.6-r1 and 4.0.15-r2.

A high-severity security vulnerability (CVE-2026-76844) affects the argo-workflows package due to an issue in zlib 1. The flaw impacts versions prior to 4.1.6-r1 and 4.0.15-r2. It allows an attacker to cause integrity and availability impacts without requiring privileges or user interaction. A patch is available to address this vulnerability.