Poznaj podatności. Chroń swoje aplikacje.

Wysoka 09.10.2026

CVE-2026-108260

@tinacms/web-components: `tina-markdown` zapisuje adresy URL odnośników w `href` bez walidacji schematu, umożliwiając stored XSS

Brak weryfikacji schematu URL w odnośnikach rich-text w @tinacms/web-components umożliwia atak typu stored XSS, pozwalając na wykonanie złośliwego kodu w przeglądarkach odwiedzających witrynę.

npm

@tinacms/web-components

Średnia 08.10.2026

CVE-2026-107718

AdonisJS: Unencoded route parameters can produce open redirects

npm

@adonisjs/http-server

Krytyczna 08.10.2026

CVE-2026-107722

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

npm

fast-jwt

Wysoka 08.10.2026

CVE-2026-61426

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

npm

praisonai

Średnia 08.10.2026

CVE-2026-107388

music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS

npm

music-metadata

Krytyczna 08.10.2026

CVE-2026-106446

Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)

npm

handlebars

Wysoka 08.10.2026

CVE-2026-107375

JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

npm

generator-jhipster

Wysoka 08.10.2026

CVE-2026-107303

JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob

npm

generator-jhipster, react-jhipster

Średnia 08.10.2026

CVE-2026-107299

msgpack5: Reserved byte can cause unbounded stream buffering

npm

msgpack5

Wysoka 07.10.2026

CVE-2026-94483

Next.js has Server-Side Request Forgery in Image Optimization

npm

next

Wysoka 07.10.2026

CVE-2026-105856

Payload: SQL injection in SQLite/Postgres

npm

@payloadcms/db-d1-sqlite, @payloadcms/db-postgres, @payloadcms/db-sqlite +1

Średnia 07.10.2026

CVE-2026-105864

@payloadcms/plugin-multi-tenant has a cross-tenant create issue

npm

@payloadcms/plugin-multi-tenant

Wysoka 07.10.2026

CVE-2026-106455

Backstage: Improper validation of MkDocs plugin configuration in TechDocs

npm

@backstage/plugin-techdocs-node

Średnia 07.10.2026

CVE-2026-106460

Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

npm

@backstage/plugin-auth-node

Krytyczna 07.10.2026

CVE-2026-93605

vm2 contains a sandbox escape vulnerability

npm

vm2

Średnia 07.10.2026

CVE-2026-106561

Backstage has a sensitive information disclosure in Kubernetes resource queries

npm

@backstage/plugin-kubernetes-backend

Wysoka 07.10.2026

CVE-2026-106486

Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions

npm

@backstage/plugin-scaffolder-backend-module-bitbucket-cloud, @backstage/plugin-scaffolder-backend-module-bitbucket-server

Średnia 07.10.2026

CVE-2026-106491

Backstage: Improper input validation in proxy-backend

npm

@backstage/plugin-proxy-backend

Średnia 07.10.2026

CVE-2026-106506

Backstage has improper input validation in scaffolder task list ordering

npm

@backstage/plugin-scaffolder-backend

Krytyczna 07.10.2026

CVE-2026-73487

Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

npm

flowise, flowise-components

Średnia 07.10.2026

CVE-2026-106109

Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories

npm

@quasar/app-vite

Wysoka 07.10.2026

CVE-2026-106104

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

npm

quasar

Wysoka 07.10.2026

CVE-2026-106103

Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

npm

@quasar/icongenie

Wysoka 07.10.2026

CVE-2026-57449

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

npm

@actual-app/sync-server