ip-address (npm) EUVD-2026-88396

Command injection in simple-git, the Node.js library for running git commands and published on npm, affects all releases

Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allo

Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one

Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary command

Improper memory allocation control in ExifReader before 4.41.1 allows remote attackers to exhaust heap memory and termin

Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack a

Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a craf

Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions for

The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applicat

Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one

Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or

Remote code execution in the PraisonAI TypeScript `codeMode` tool (npm package `praisonai` <= 1.7.1) lets an attacker wh