Security advisories

high2026-09-08

CVE-2026-84370-SVGO: removeScripts allows executable links through namespace and control-character bypasses

svg/svgo · GHSA-w27v-7q3p-w38r

medium2026-09-08

CVE-2026-84369-SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements

svg/svgo · GHSA-4vpr-x523-8j87

medium2026-09-08

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

nodemailer/nodemailer · GHSA-8m3c-c648-2xjj

high2026-09-08

CVE-2026-83616-xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

xmldom/xmldom · GHSA-c7q8-3ch8-vqpv

high2026-09-08

CVE-2026-83617-xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom/xmldom · GHSA-jxjr-3g7g-3944

high2026-09-08

CVE-2026-83608-xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom/xmldom · GHSA-27p8-2357-5qqv

high2026-09-08

CVE-2026-83609-xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom/xmldom · GHSA-3px3-54cx-rmw9

high2026-09-08

CVE-2026-83618-xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

xmldom/xmldom · GHSA-vr34-hp96-76pp

medium2026-09-08

CVE-2026-83611-xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

xmldom/xmldom · GHSA-6h8r-xr42-gp59

high2026-09-08

CVE-2026-83613-xmldom: Quadratic-time attribute deduplication

xmldom/xmldom · GHSA-8344-3jmq-59r6

high2026-09-08

CVE-2026-83619-xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

xmldom/xmldom · GHSA-x4fp-j954-r2f4

high2026-09-08

CVE-2026-83615-xmldom: Quadratic-memory consumption

xmldom/xmldom · GHSA-965w-775f-mr7g

high2026-09-08

CVE-2026-83614-xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

xmldom/xmldom · GHSA-93r5-fhx6-vmg9

high2026-09-08

CVE-2026-83612-xmldom: HTML raw-text closing-tag case mismatch causes output amplification

xmldom/xmldom · GHSA-6mj3-qw4j-hgrw

critical2026-09-08

CVE-2026-84372-Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

predis/predis · GHSA-w6f5-v2h6-g786

critical2026-09-08

CVE-2026-77635-CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

cakephp/cakephp · GHSA-fxf7-vhh8-7vpq

high2026-09-08

CVE-2026-77634-CakePHP: SmtpTransport vulnerable to CRLF header injection

cakephp/cakephp · GHSA-2qh5-382h-3jpc

low2026-09-08

CVE-2026-84368-joi: Prototype pollution via a `__proto__` language key in custom messages

hapijs/joi · GHSA-6w3j-5fw6-r9vr

medium2026-09-08

CVE-2026-85062-Colord: Slow rejection of oversized malformed color strings

omgovich/colord · GHSA-2wm5-q62r-hmrv

critical2026-09-08

CVE-2026-75604-Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

vercel/next.js · GHSA-p293-qw3h-jr36