Published threat advisories for March 27, 2026

A code injection vulnerability in the Happy DOM JavaScript library allows for remote code execution by injecting arbitrary JavaScript expressions into module scripts. This occurs because the `ECMAScriptModuleCompiler` directly interpolates unsanitized content into generated code. Systems processing specially crafted mo

NVD modified: NVD date unavailable

A vulnerability in the Handlebars templating technology could allow an attacker to execute arbitrary JavaScript on affected servers by supplying a crafted Abstract Syntax Tree (AST) to the `compile()` function. This could lead to remote code execution if the server processes unsanitized input. It is uncertain if your e

NVD modified: NVD date unavailable

A vulnerability in the Forge JavaScript library may allow improperly signed certificates to be accepted as valid, potentially undermining trust in systems that rely on certificate validation for security. Forge is used to implement Transport Layer Security. The library fails to enforce certain certificate requirements,

NVD modified: NVD date unavailable

A flaw in Undertow allows attackers to smuggle requests by exploiting differences in header name parsing between Undertow and upstream proxies, potentially bypassing security controls and gaining unauthorized access to resources. This vulnerability impacts external-facing web services and applications, making it import

NVD modified: NVD date unavailable

A vulnerability in Undertow allows for request smuggling by sending specific header terminators, potentially leading to unauthorized access or manipulation of web requests when used with certain proxy servers.

NVD modified: NVD date unavailable

OpenBao installations with enabled OIDC/JWT authentication and specific role configurations are vulnerable to cross-site scripting. This flaw, present before version 2.5.2, could allow an attacker to steal a victim's web UI authentication token via a crafted error message on a failed login. The vendor has addressed thi

NVD modified: NVD date unavailable

A chained attack involving SQL Expressions and a Grafana Enterprise plugin can lead to remote code execution. This vulnerability impacts Grafana instances with the `sqlExpressions` feature enabled. An attacker could potentially run arbitrary code on affected systems, posing a risk to service integrity and availability.

NVD modified: NVD date unavailable

The `dd-trace-java` component has a vulnerability that could allow unauthorized code execution. This affects organizations using Java 16 or earlier with specific network configurations. Attackers could gain control of systems and compromise data. Action is advised to mitigate risk.

NVD modified: NVD date unavailable

OpenTelemetry Java instrumentation has a vulnerability where an attacker with network access to a JMX or RMI port on an older JDK (16 or earlier) could achieve remote code execution. This occurs when the instrumentation's RMI feature deserializes unfiltered incoming data, impacting system integrity and confidentiality.

NVD modified: NVD date unavailable