Change Ledger
Official changes we have detected — recalls, end of support, exploited vulnerabilities, breaches. Every signal links to its source and to a public, tamper-evident evidence ledger.
Product Recall: Horace Vetiver Primavera Beard Oil sold via Amazon (2609-0073)
The product presents a risk to health because it was found that the fragrance concentration exceeds safety limits for leave-on facial products. This could cause consumers to experience skin irritatio…
CVE-2026-114144: toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal…
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit sequences from lib/parser.js to BigInt() before red…
CVE-2026-114143: toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every…
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table header…
CVE-2026-114141: toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() func…
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments…
CVE-2026-114142: toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled prope…
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produc…
CPSC, DeWalt Industrial Tool Co. Announce Recall to Repair Electric Screwdrivers
The screwdrivers were sold under the DeWalt, GRABBER, and Black & Decker Industry & Construction brand names. The DeWalt, model numbers are DW251, DW252, DW257, DW260K, DW265, DW266, DW267, DW268, DW…
Azurion 7 Systems
Azurion 7 Systems — Performance — Radiology
i-STAT hs-TnI Cartridge
i-STAT hs-TnI Cartridge — Performance — Chemistry
Galaxie Brands Corporation recalls OVERTIME Punch Out due to labelling issue
OVERTIME Punch Out dried cannabis flower — Labelling and packaging — Cannabis
Femyso: Affected lot may contain two green Mifepristone cartons or two pink Misoprostol cartons instead of one of each.
Femyso Mifepristone 200mg / Misoprostol 200 mcg tablet — Packaging — Drugs
FP3D™ Resins
FP3D™ Resins — Performance — Dental
CPSC, NIKE Announce Recall of Men's "Air Face Up" Basketball Shoes
The NIKE Air Face Up men's basketball shoes being recalled are model numbers 830080, 139358 and 630327. The model number is located on the label on the inside tongue of the shoe, above the UPC code.…
CVE-2026-107389: music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser…
music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-toke…
CVE-2026-86146: Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache …
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle req…
CPSC, Rubie's Costume Co. Inc. Announce Recall of Children's Vampire Capes and Witch Brooms
The vampire capes are made of black vinyl. The edges of the cape are scalloped. The capes are packaged in a plastic sleeve with a cardboard insert, which reads in part, "Child's Vinyl Vampire Cape...…
Cat ear headset BT612 — Safety Gate alert SR/03008/26
Dangerous product alert (chemical, environment) for Cat ear headset BT612 (Headphones ). Check batch numbers and measures on the official alert.
Levantiner Naturschwamm — Safety Gate alert SR/02873/26
Dangerous product alert (health risk other) for Naturschwamm (Intimate care sponges). Check batch numbers and measures on the official alert.
MT- Glowing Slingshot — Safety Gate alert SR/02961/26
Dangerous product alert (injuries) for MT- Glowing Slingshot (Toy slingshot). Check batch numbers and measures on the official alert.
Ousuga Blue Balloons, 50 St 12 Tums Latex dark blu — Safety Gate alert SR/03021/26
Dangerous product alert (chemical) for Blue Balloons, 50 St 12 Tums Latex dark blu (Balloons). Check batch numbers and measures on the official alert.
COOL.TRICYCLES/ Tricycle électrique pour garçons, jouets interactifs éducatifs et créatifs — Safety Gate alert SR/03020/26
Dangerous product alert (chemical) for COOL.TRICYCLES/ Tricycle électrique pour garçons, jouets interactifs éducatifs et créatifs (Toy tricycle). Check batch numbers and measures on the official aler…
relaxdays Treppenschutzgitter ohne Bohren — Safety Gate alert SR/03022/26
Dangerous product alert (entrapment, injuries, strangulation) for Treppenschutzgitter ohne Bohren (Stair gate). Check batch numbers and measures on the official alert.
CVE-2026-113662: ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authen…
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated user with import access to a target type can supply an object or operat…
CVE-2026-113666: ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of Apostrophe…
ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a projection exclusion path t…
CVE-2026-112957: ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages d…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level re…
CVE-2026-113651: ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to up…
ApostropheCMS is an open-source Node.js content management system, and uploadfs is its file storage library. Prior to uploadfs 1.28.0, attacker-controlled paths that reach the local backend can conta…
CVE-2026-113670: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full pa…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypa…
CVE-2026-113661: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi…
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default configuration that…
CVE-2026-113657: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi…
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From sanitize-html 2.17.7 until 2.18.0, an application configur…
CVE-2026-113710: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change end…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service password-change endpoint verifies the current password but does not use the login module’s failed-…
CVE-2026-113671: ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI help…
ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated im…
CVE-2026-113654: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi…
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags config…
CVE-2026-112958: ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget s…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute…
CVE-2026-113664: ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authen…
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a…
CVE-2026-113650: ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allo…
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is…
CVE-2026-113660: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API …
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted docu…
CVE-2026-113652: ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leak…
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is co…
CVE-2026-113668: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-ty…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCh…
CVE-2026-113656: ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its …
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation…
CVE-2026-111756: follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to…
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (…
CVE-2026-113669: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passpor…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bear…
CVE-2026-113658: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV co…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory befo…
CVE-2026-113665: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATC…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying…
CVE-2026-113649: ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0…
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but la…
CVE-2026-114102: adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.…
adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.j…
CVE-2026-113659: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parsed by apos.http.parseQu…
CVE-2026-113711: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the imp…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early au…
CVE-2026-113653: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered rel…
CVE-2026-113667: ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-rec…
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the Form add-on, 1.2.1 of login-recaptcha, and 1.3.0 of login-hcaptcha, these three CAPTCHA integrations interpola…
CVE-2026-113655: ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitim…
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted paren…
CVE-2026-113648: ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API e…
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecm…
Only see what affects you
Add what you own or use. Reality Radar matches new official changes to your items and explains why.