CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

gRPC-Go has an authorization bypass via missing leading slash in :path

jsPDF has PDF Object Injection via Unsanitized Input in addJS Method

jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Execution

Go JOSE affect by a panic in JWE decryption

Denial of service in github.com/jackc/pgproto3/v2

Incorrect parsing of IPv6 host literals in net/url

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

jsPDF has Local File Inclusion/Path Traversal vulnerability

SpdyStream: DOS on CRI

jsPDF has a PDF Object Injection via FreeText color

jsPDF has HTML Injection in New Window paths

React Router vulnerable to XSS via Open Redirects

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions