ip-address CVE-2026-101910

Command injection in simple-git, the Node.js library for running git commands and published on npm, affects all releases

Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allo

Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one

Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary command

Improper memory allocation control in ExifReader before 4.41.1 allows remote attackers to exhaust heap memory and termin

Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack a

Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a craf

Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions for

Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one

Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHo

Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or

Remote code execution in the PraisonAI TypeScript `codeMode` tool (npm package `praisonai` <= 1.7.1) lets an attacker wh