Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 713 threats · Monday, Oct 19· last check 2026-11-04 07:23 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Monday, Oct 19

Most severe in everything

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassmercury

Deserialization of Untrusted Data vulnerability in Apache Camel

H3C Magic NX15 router: path argument in RPC interface allows code injectionH3C Magic NX15

H3C Magic NX15 router: remote OS command injection in usrlistMagic NX15

Monday, Oct 19

MEDIUM5.7Zephyr Bluetooth HFP: remote peer can exhaust buffers and halt BluetoothRuntime2026-10-19 20:57 UTCby NVD–WHAT TO DO MEDIUM6.1Zephyr RTIO: syscall checks read access but writes output pointersRuntime2026-10-19 20:52 UTCby NVD–WHAT TO DO MEDIUM6.8IBM TS4500 tape library: race condition grants unauthorized admin privilegesInfrastructure2026-10-19 23:17 UTCby NVD–WHAT TO DO MEDIUM6.3MISP Modules: html_to_markdown SSRF reaches internal address rangesPackage2026-10-19 23:17 UTCby NVD–WHAT TO DO MEDIUM6.6H3C Magic NX15 router: upload path traversal lets remote users write filesInfrastructure2026-10-19 23:17 UTCby NVD–WHAT TO DO CRITICAL9.9H3C Magic NX15 router: path argument in RPC interface allows code injectionH3C Magic NX15Infrastructure2026-10-19 23:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.9PUBLIC EXPLOITH3C Magic NX15 router: remote OS command injection in usrlistMagic NX15Infrastructure2026-10-19 23:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.3IBM TS4500 tape library: sessions not invalidated, allowing user impersonationInfrastructure2026-10-19 23:17 UTCby NVD–WHAT TO DO MEDIUM5.5IBM TS4500 Library: sessions stay valid after logout, enabling impersonationInfrastructure2026-10-19 23:17 UTCby NVD–WHAT TO DO MEDIUM6.5IBM TS4500 tape library: crafted SMTP requests cause denial of serviceInfrastructure2026-10-19 23:17 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @an1mshnpmb9c84920/stage-fn-m19p2 (npm)@an1mshnpmb9c84920/stage-fn-m19p2Package2026-10-19 22:19 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @an1mshnpmb9c84920/gat-scope-target-125ec19a (npm)@an1mshnpmb9c84920/gat-scope-target-125ec19aPackage2026-10-19 22:19 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @an1mshnpmb9c84920/pipe-dns-m19t2 (npm)@an1mshnpmb9c84920/pipe-dns-m19t2Package2026-10-19 22:19 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @an1mshnpmb9c84920/stage-outer-m19s5 (npm)@an1mshnpmb9c84920/stage-outer-m19s5Package2026-10-19 22:19 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @an1mshnpmb9c84920/stage-repo-m19g7 (npm)@an1mshnpmb9c84920/stage-repo-m19g7Package2026-10-19 22:19 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @an1mshnpmb9c84920/oidc-cross-cafb9d929e (npm)@an1mshnpmb9c84920/oidc-cross-cafb9d929ePackage2026-10-19 22:19 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @an1mshnpmb9c84920/pipe-compat-m19r8 (npm)@an1mshnpmb9c84920/pipe-compat-m19r8Package2026-10-19 22:19 UTCby osv-malicious–UNINSTALL NOT SCOREDNOT SCOREDCVE-2026-57529 was rejected by its CNA and withdrawnOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-57528 was rejected and withdrawn by its numbering authorityOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-57526 was rejected and withdrawn by its numbering authorityOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-57519 withdrawn by its CVE Numbering Authority, no flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-57515 was rejected by its numbering authority, not a real flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-57514 was rejected by its numbering authority and withdrawnOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-57513 was rejected by its CVE Numbering AuthorityOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-57512 was rejected and withdrawn by its numbering authorityOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-56714 withdrawn by its numbering authority, no flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO HIGH8.8MLflow FileStore trace IDs allow path traversal and arbitrary file writesmlflowPackage2026-10-19 22:17 UTCby GitHub Advisories–FIX 3.17.2 MEDIUM6.9Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutesPillowPackage2026-10-17 10:41 UTCby GitHub Advisories–FIX 13.0.0 CRITICAL9.2PUBLIC EXPLOITPillow: Argument Injection in Ghostscript call, potentially leading into RCEPillowPackage2026-10-17 10:39 UTCby GitHub Advisories–FIX 13.0.0 MEDIUM6.9Pillow: Image.quantize() with empty palette leaks uninitialized stack memoryPillowPackage2026-10-17 10:41 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.7Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripsPillowPackage2026-10-17 10:37 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.8Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readPillowPackage2026-10-17 10:36 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.7Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)pillowPackage2026-10-17 10:36 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.7Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)PillowPackage2026-10-17 10:42 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.2Pillow: Invalid free in FreeType glyph rendering when a stroker is activepillowPackage2026-10-17 10:40 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.7Pillow: MSP RLE decoder expands a tiny file into unbounded memorypillowPackage2026-10-17 10:42 UTCby GitHub Advisories–FIX 13.0.0 MEDIUM6.9Pillow: Quadratic GIF comment copying during savepillowPackage2026-10-17 10:41 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.7Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cyclePillowPackage2026-10-17 10:43 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.7Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0pillowPackage2026-10-17 10:40 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.8Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelsPillowPackage2026-10-17 10:35 UTCby GitHub Advisories–FIX 13.0.0 CRITICAL9.2PUBLIC EXPLOITPillow: Heap buffer overflow in ImagingJpegDecodePillowPackage2026-10-17 10:34 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.7Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformPillowPackage2026-10-17 10:39 UTCby GitHub Advisories–FIX 13.0.0 MEDIUM6.9Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()PillowPackage2026-10-17 10:41 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.7Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSPillowPackage2026-10-17 10:38 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.7Pillow: APNG background disposal allocates full canvas before decompression bomb checkPillowPackage2026-10-17 10:43 UTCby GitHub Advisories–FIX 13.0.0 CRITICAL9.2Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionpillowPackage2026-10-17 20:36 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.7Pillow: Out-of-bounds access in _imagingmorph on a zero-width imagePillowPackage2026-10-17 10:38 UTCby GitHub Advisories–FIX 13.0.0 MEDIUM5.9Pillow: Heap use-after-free when encoding TIFF to an in-memory bufferpillowPackage2026-10-17 10:43 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.2Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagesPillowPackage2026-10-17 10:40 UTCby GitHub Advisories–FIX 13.0.0 MEDIUM6.5Dolibarr: flaw in document.php lets remote attackers bypass CSP protectionOther2026-10-19 22:17 UTCby NVD–WHAT TO DO HIGH8.0Netis EAP930 firmware: CGI debug endpoint backdoor reachable remotelyInfrastructure2026-10-19 22:17 UTCby NVD–WHAT TO DO MEDIUM4.3TiBillet Lespass: image URL import enables server-side request forgeryPackage2026-10-19 22:17 UTCby NVD–WHAT TO DO HIGH7.8GIMP: crafted XCF file triggers use-after-free and possible code executionPackage2026-10-19 22:17 UTCby NVD–WHAT TO DO HIGH7.8GIMP: crafted XCF file triggers use-after-free during image loadPackage2026-10-19 22:17 UTCby NVD–WHAT TO DO HIGH7.8GIMP: crafted PSD thumbnail causes heap overflow and possible code executionPackage2026-10-19 22:17 UTCby NVD–WHAT TO DO HIGH7.1TP-Link Tapo C210: unauthenticated API leaks credential material, enabling camera accessInfrastructure2026-10-19 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3TP-Link Tapo C210: authentication bypass lets attackers control camera without loginInfrastructure2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54657 was withdrawn and rejected, no vulnerability describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54656: withdrawn record, no product or flaw describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54655 was rejected and withdrawn; no product flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54654 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54653 was rejected and withdrawn; no product flaw existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54652 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54651 was withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54650 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54649 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54648 was withdrawn and describes no real product flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54647 was withdrawn and carries no vulnerabilityOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54646 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDRejected CVE record: no vulnerability, withdrawn from a CNA poolOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54644 rejected: unassigned CNA pool candidate, no real flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54643 was withdrawn and is not a real vulnerabilityOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54642 was withdrawn; no product flaw describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54641 was withdrawn; no product flaw is describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE entry: rejected candidate with no assigned issueOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54639 withdrawn: rejected candidate, no vulnerability describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE-2024-54638: rejected candidate, no vulnerability describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54637 withdrawn: rejected candidate, no product or flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54636 was withdrawn and rejected, no vulnerability describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54635 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54634 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54633 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54632 was rejected and withdrawn; no product flaw identifiedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54631: rejected candidate, no vulnerability describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54630 was withdrawn and rejected; no product flaw existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54629 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54628 was withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE entry: rejected candidate with no vulnerability behind itOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54626 withdrawn: rejected, no product or flaw describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54625 withdrawn: rejected, no product or flaw describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54624 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54623 was withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54622 was rejected and withdrawn; no product flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54621 was withdrawn and describes no real flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54620 was withdrawn; no vulnerability is describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE record: no vulnerability, CNA pool assignment errorOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE-2024-54618: rejected candidate, no vulnerability describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54617: withdrawn record, no vulnerability describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54616 was withdrawn and rejected, describes no real flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54615 was rejected and withdrawn; no product flawOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54614 rejected: reserved candidate never assigned to any issueOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54613 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54612 was withdrawn: the record was never a real issueOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54611 was rejected and withdrawn; no product flaw describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54610 was rejected and withdrawn; no product flaw describedOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54609 was rejected and withdrawn, no vulnerability existsOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54608 was withdrawn: reserved ID, no vulnerabilityOther2026-10-19 22:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54607 withdrawn: rejected candidate, no product or flawOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE record with no vulnerability; no product flawOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54605 was withdrawn; no product flaw is describedOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54604 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54603: withdrawn entry, no vulnerability describedOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54602 was rejected and withdrawn; no vulnerability to fixOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE entry with no vulnerability detailsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54600 withdrawn: no product or flaw was ever assignedOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54599 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54598 was rejected and withdrawn, no vulnerability confirmedOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54597 was withdrawn; no vulnerability existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54596 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54595 was withdrawn and carries no vulnerabilityOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54594 was rejected and withdrawn; no product flaw existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54593 was rejected and withdrawn; no vulnerability to fixOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54592 was rejected and withdrawn; no product flaw existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54591 was rejected and withdrawn; no product flaw existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54590 was withdrawn; no vulnerability existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54589 was rejected and withdrawn; no product flawOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54588 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54587 was rejected and withdrawn, no product flawOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE record: no vulnerability, candidate was never assignedOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54585 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54584 was withdrawn: no vulnerability, rejected by its CNAOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2024-54583 was rejected and withdrawn; no flaw existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE record: no vulnerability, candidate was never assignedOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2023-42999 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2023-42998 was rejected and withdrawn; no product flawOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2023-42997 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE record: no vulnerability, candidate was never assignedOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2023-42995 was rejected and withdrawn; no vulnerability describedOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2023-42994 was rejected and withdrawn; no product flaw existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2023-42993 was rejected and withdrawn; no vulnerability existsOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2023-42992 was rejected and has no product or impactOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2023-42991 was rejected and has no product or impactOther2026-10-19 22:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2023-42990 was withdrawn and carries no vulnerabilityOther2026-10-19 22:16 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @decoopus/claude-setup (npm)@decoopus/claude-setupPackage2026-10-19 21:47 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in api-anthropic (npm)api-anthropicPackage2026-10-19 21:47 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in codex-setup (npm)codex-setupPackage2026-10-19 21:47 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in chatgpt-pro-activator (npm)chatgpt-pro-activatorPackage2026-10-19 21:47 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in chatgpt-desktop-setup (npm)chatgpt-desktop-setupPackage2026-10-19 21:47 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @decoopus/chatgpt-setup (npm)@decoopus/chatgpt-setupPackage2026-10-19 21:47 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in claude-desktop-setup (npm)claude-desktop-setupPackage2026-10-19 21:47 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in chatgpt-pro-setup-tool (npm)chatgpt-pro-setup-toolPackage2026-10-19 21:47 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in asurion (PyPI)asurionPackage2026-10-19 21:22 UTCby osv-malicious–UNINSTALL HIGH8.8Zephyr OSDP: oversized reader reply overflows stack, risking control-flow hijackzephyrRuntime2026-10-17 13:00 UTCby InfraStack Analyst–FIX 4.5.0 MEDIUM5.9Zephyr UpdateHub: malformed CoAP probe reply crashes the device on each pollRuntime2026-10-17 12:59 UTCby NVD–WHAT TO DO MEDIUM6.5Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)pillowPackage2026-10-17 10:35 UTCby GitHub Advisories–FIX 13.0.0 MEDIUM6.3Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizePillowPackage2026-10-17 10:39 UTCby GitHub Advisories–FIX 13.0.0 CRITICAL9.2Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOPillowPackage2026-10-17 10:54 UTCby GitHub Advisories–FIX 13.0.0 HIGH7.5Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()PillowPackage2026-10-17 10:41 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.2Pillow: Infinite loop in MIC n_frames when the embedded TIFFPillowPackage2026-10-17 10:41 UTCby GitHub Advisories–FIX 13.0.0 HIGH7.5php-archive: zip extraction path traversal lets attackers write outside target folderPackage2026-10-19 21:17 UTCby NVD–WHAT TO DO HIGH7.5imagemagick-php: font file argument lets remote attackers inject OS commandsorbitale/imagemagick-phpPackage2026-10-19 21:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9configobj: regex in _sectionmarker can be slowed to cause denial of servicePackage2026-10-19 21:17 UTCby NVD–WHAT TO DO MEDIUM4.3SMR: album website field enables server-side request forgeryPackage2026-10-19 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDPerl Plack ETag middleware leaks file inode numbers in responsesPackage2026-10-18 11:14 UTCby NVD–WHAT TO DO MEDIUM4.4Terragrunt catalog predictable temp symlink clobber in github.com/gruntwork-io/terragruntgithub.com/gruntwork-io/terragruntPackage2026-09-22 12:20 UTCby Go vuln DB–FIX 1.1.1 NOT SCOREDNOT SCOREDSliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder in github.com/bishopfox/slivergithub.com/bishopfox/sliverPackage2026-10-19 21:08 UTCby Go vuln DB–FIX 1.7.6 NOT SCOREDNOT SCOREDVikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/apicode.vikunja.io/apiPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO NOT SCOREDNOT SCOREDVikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/apicode.vikunja.io/apiPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO MEDIUMNOT SCOREDVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/apicode.vikunja.io/apiPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO MEDIUMNOT SCOREDVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/apicode.vikunja.io/apiPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO NOT SCOREDNOT SCOREDVikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/apicode.vikunja.io/apiPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO NOT SCOREDNOT SCOREDVikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint in code.vikunja.io/apicode.vikunja.io/apiPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO NOT SCOREDNOT SCOREDCoraza has Cookie Parser Confusion in github.com/corazawaf/corazagithub.com/corazawaf/corazaPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO NOT SCOREDNOT SCOREDCoraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/corazagithub.com/corazawaf/corazaPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO NOT SCOREDNOT SCOREDCoraza: Resource exhaustion via deferred file handle accumulation in multipart body processor in github.com/corazawaf/corazagithub.com/corazawaf/corazaPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO HIGHNOT SCOREDCoraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/corazagithub.com/corazawaf/corazaPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO NOT SCOREDNOT SCOREDCoraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) in github.com/corazawaf/corazagithub.com/corazawaf/corazaPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO NOT SCOREDNOT SCOREDCoraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/corazagithub.com/corazawaf/corazaPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO MEDIUMNOT SCOREDCoraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations in github.com/corazawaf/corazagithub.com/corazawaf/corazaPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO NOT SCOREDNOT SCOREDCoraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/corazagithub.com/corazawaf/corazaPackage2026-10-19 21:08 UTCby Go vuln DB–WHAT TO DO CRITICALINCIDENTSentry: Sentry is downSentryVendor2026-10-19 20:39 UTCby status page–WHAT TO DO MEDIUMINCIDENTCloudflare: Cloudflare Secure Web Gateway and DLP enforcement issues for Google GeminiCloudflareVendor2026-10-19 20:30 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: MMS Delivery Delays from a Subset of Twilio Long Codes to AT&T United StatesTwilioVendor2026-10-19 20:26 UTCby status page–WHAT TO DO HIGH8.8Dell Application Store: missing authentication lets nearby attackers run codeVendor2026-10-19 20:20 UTCby NVD–WHAT TO DO HIGH7.8Dell Application Store: uncontrolled path lets local users run codeOther2026-10-19 20:20 UTCby NVD–WHAT TO DO HIGH7.0Dell Application Store: incorrect permissions expose sensitive data to local usersOther2026-10-19 20:20 UTCby NVD–WHAT TO DO HIGH8.7Grav CMS: anonymous image resize requests exhaust server memory and crash sitesRuntime2026-10-05 01:54 UTCby NVD–WHAT TO DO HIGH8.7Grav CMS: page editors can read secrets and expose them publiclygetgrav/gravRuntime2026-10-05 00:00 UTCby InfraStack Analyst–FIX 2.2.2 CRITICAL9.3Grav CMS: page editors can delete, move, or read files on servergetgrav/gravPackage2026-10-05 00:00 UTCby InfraStack Analyst–FIX 2.2.2 MEDIUM9.8Grav API plugin: unauthenticated requests exhaust disk and bypass page rulesgrav-plugin-apiPackage2026-10-04 23:59 UTCby InfraStack Analyst–FIX 1.0.42 HIGH8.8Traefik: Kubernetes Ingress annotations reach other namespaces' credentials and certificatestraefikRuntime2026-10-05 12:05 UTCby NVD–FIX 2.11.46 HIGH8.7Craft CMS: Twig create() blocklist bypass lets admins write PHP filesRuntime2026-10-05 17:27 UTCby NVD–WHAT TO DO CRITICAL9.8Craft CMS: site-scoped GraphQL tokens can edit other sites' contentRuntime2026-10-05 17:29 UTCby NVD–WHAT TO DO HIGH8.7Craft CMS: reused email verification codes let attackers reset passwords and take over accountscraftcms/cmsRuntime2026-10-05 17:31 UTCby InfraStack Analyst–FIX 5.11.0 HIGH8.7Craft CMS: admin field layout input lets an admin run OS commandsRuntime2026-10-05 17:43 UTCby NVD–WHAT TO DO HIGH8.8Craft CMS: Control Panel users can run code via Twig sandbox escapecraftcms/cmsPackage2026-10-05 17:45 UTCby InfraStack Analyst–FIX 5.11.0 HIGH8.8Craft CMS: authenticated control panel users can run code on the serverPackage2026-10-05 17:48 UTCby NVD–WHAT TO DO HIGH7.1Craft CMS: Twig sandbox bypass leaks security key and database credentialsPackage2026-10-05 17:49 UTCby NVD–WHAT TO DO HIGH8.8Craft CMS: Twig filter lets control panel users run code on servercraftcms/cmsPackage2026-10-05 17:51 UTCby InfraStack Analyst–FIX 4.18.8 LOW2.3Parse Server: session creation skips class permissions, sessions survive logoutPackage2026-10-04 11:31 UTCby NVD–WHAT TO DO MEDIUM6.9Parse Server: user update leaks usernames and passwords to unauthorized callersPackage2026-10-05 00:11 UTCby NVD–WHAT TO DO MEDIUM4.3anx-calibre-manager: LLM base URL setting enables server-side request forgeryAI agents & MCP2026-10-19 20:17 UTCby NVD–WHAT TO DO HIGH7.1GIMP: crafted XCF file leaks heap memory and crashes the editorPackage2026-10-19 20:17 UTCby NVD–WHAT TO DO MEDIUM4.3clientst0r: Property URL Importer lets attackers make server-side requestsOther2026-10-19 20:17 UTCby NVD–WHAT TO DO LOW3.7markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabledmarkdown-itPackage2026-10-16 02:24 UTCby GitHub Advisories–FIX 14.3.3 NOT SCOREDNOT SCOREDCVE-2024-54581 rejected: reserved in a CNA pool, never assignedOther2026-10-19 20:17 UTCby NVD–WHAT TO DO MEDIUMINCIDENTTwilio: MMS Delivery Delays from a Subset of Twilio Long Codes to Telus CanadaTwilioVendor2026-10-19 19:35 UTCby status page–WHAT TO DO MEDIUM5.5GIMP: crafted SBZ palette import crashes the applicationPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO HIGH7.5Wubang safety management system: SQL injection in /ws.asmx allows remote command executionVendor2026-10-19 19:17 UTCby NVD–WHAT TO DO MEDIUM5.0Clawhost reverse proxy lets attackers redirect users to arbitrary sitesOther2026-10-19 19:17 UTCby NVD–WHAT TO DO MEDIUM4.8grandnode2: product description template lets scripts run in shoppers' browsersPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDCpanel::JSON::XS: incremental parser lets a peer burn CPU with non-ASCII JSONPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDCpanel::JSON::XS: canonical encoding sorts some keys wronglyPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDCpanel::JSON::XS: freed filter callbacks let a decode crash the processPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDCpanel::JSON::XS: failed THAW call leaks memory, enabling denial of servicePackage2026-10-19 19:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDCpanel::JSON::XS: encoding stringify values leaks memory until the process exhausts memoryPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDCpanel::JSON::XS: chunked input changes decoded top-level numbers in incr_parsePackage2026-10-19 19:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCpanel::JSON::XS: parser cloned into threads can crash Perl processesPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCpanel::JSON::XS: out-of-bounds write during canonical hash encoding can crash PerlPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCpanel::JSON::XS: incremental parser buffers input past max_size, exhausting memoryPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCpanel::JSON::XS: duplicate-key decoding leaks memory, exhausting process memoryPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDCpanel::JSON::XS: crafted exponent numbers exhaust memory when re-encodedPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDCpanel::JSON::XS: malformed UTF-8 accepted in bare hash keysPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCpanel::JSON::XS: duplicate bare keys can crash Perl or read chosen memoryPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCpanel::JSON::XS: nested tagged values crash Perl process via stack exhaustionPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDCpanel::JSON::XS: rejected JSON objects leak memory, repeated requests exhaust process memoryPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO CRITICAL9.8Cognition: unauthenticated API lets remote users run shell commandsCognicellAI/CognitionAI agents & MCP2026-10-19 19:17 UTCby InfraStack Analyst–FIX 0.13.0 MEDIUM5.1Fenrir Sleipnir Android browser: fullscreen mode lets sites fake the address barOther2026-10-19 19:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted AC4 file triggers heap use-after-free crashPackage2026-10-19 19:17 UTCby NVD–WHAT TO DO HIGH7.5IBM Concert: weak cryptography lets attackers decrypt sensitive informationIBM Concert SoftwareVendor2026-10-19 18:17 UTCby InfraStack Analyst–FIX 3.0.1.1 MEDIUM5.1Element X iOS: crafted call URL loads attacker page with camera and microphonePackage2026-06-15 10:35 UTCby NVD–WHAT TO DO MEDIUM5.4IBM Cloud Pak System: HTML injection lets logged-in users run scripts in browsersInfrastructure2026-10-19 18:17 UTCby NVD–WHAT TO DO MEDIUM6.1IBM Concert: unauthenticated cross-site scripting in the web UIVendor2026-10-19 18:17 UTCby NVD–WHAT TO DO MEDIUM4.0IBM Concert: cached web pages readable by other local usersVendor2026-10-19 18:17 UTCby NVD–WHAT TO DO MEDIUM5.3IBM Concert: schema suggestions leak information to unauthorized usersVendor2026-10-19 18:17 UTCby NVD–WHAT TO DO LOW3.7IBM Concert: permissive CORS lets outside sites act as usersVendor2026-10-19 18:17 UTCby NVD–WHAT TO DO HIGH7.4IBM Cloud Pak System: stored XSS lets an authenticated user run scriptsInfrastructure2026-10-19 18:17 UTCby NVD–WHAT TO DO MEDIUM5.9IBM Cloud Pak System: weak cryptography lets attackers decrypt sensitive informationInfrastructure2026-10-19 18:17 UTCby NVD–WHAT TO DO MEDIUM4.7IBM Concert: heap inspection can leak sensitive information from memoryInfrastructure2026-10-19 18:17 UTCby NVD–WHAT TO DO LOW3.7IBM Concert: improper certificate validation weakens connection securityVendor2026-10-19 18:17 UTCby NVD–WHAT TO DO MEDIUM6.9TickTick Android app: exported share receiver lets local apps write arbitrary filesPackage2026-10-19 18:17 UTCby NVD–WHAT TO DO CRITICAL9.1attested-tls-poc: attestation evidence not bound to TLS, enabling relay impersonationattested-tls-pocPackage2026-10-19 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.8grandnode2: Excel product import allows path traversal via picture fieldsPackage2026-10-19 18:17 UTCby NVD–WHAT TO DO MEDIUM5.3Wuxi Wubang safety management system: upload endpoint allows cross-site scriptingVendor2026-10-19 18:17 UTCby NVD–WHAT TO DO HIGH7.5markdown-it: Quadratic complexity in smartquotes with unmatched closing quotesmarkdown-itPackage2026-09-12 06:00 UTCby GitHub Advisories–FIX 15.0.2 MEDIUM5.3Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathshonoPackage2026-09-29 06:18 UTCby GitHub Advisories–FIX 4.13.11 HIGH8.2follow-redirects sensitiveHeaders regex escaping can expose credential headersfollow-redirectsPackage2026-10-01 13:51 UTCby GitHub Advisories–FIX 1.16.1 MEDIUMNOT SCOREDSlims library system: CSRF lets attackers wipe loan history recordsOther2026-10-19 18:16 UTCby NVD–WHAT TO DO HIGH8.5Tapo C320WS camera: authenticated overflow in Wi-Fi onboarding gives root code executionInfrastructure2026-10-19 18:16 UTCby NVD–WHAT TO DO MEDIUM5.5GPAC MP4Box: heap overflow from a crafted AC4 file crashes the toolPackage2026-10-19 18:16 UTCby NVD–WHAT TO DO MEDIUM5.5GPAC MP4Box: crafted MP4 file crashes the tool with a segfaultPackage2026-10-19 18:16 UTCby NVD–WHAT TO DO MEDIUM5.5GPAC MP4Box: use-after-free crash from a crafted filePackage2026-10-19 18:16 UTCby NVD–WHAT TO DO HIGH7.5FFmpeg: crafted media file crashes decoder via H.264 null pointerffmpegPackage2026-10-19 18:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.1IBM Cloud Pak System: cross-site scripting in web UI exposes sessionsVendor2026-10-19 18:16 UTCby NVD–WHAT TO DO MEDIUMINCIDENTTwilio: RCS Delivery Receipt Delays for AT&TTwilioVendor2026-10-19 17:21 UTCby status page–WHAT TO DO LOW3.7IBM Concert: weak cryptography could let attackers decrypt sensitive informationVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM5.3IBM Concert: unauthorized users can inject data into log messagesVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5IBM MQ: crafted message from authenticated user crashes consuming applicationsibm mqVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM4.3IBM MQ Operator: off-by-one buffer overflow crashes processes via crafted object namesibm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5IBM MQ Operator: crafted message lets authenticated user crash serviceibm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM4.3IBM MQ Operator: malformed compressed data triggers minor out-of-bounds readibm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO HIGH9.8IBM MQ Operator: TLS certificate parsing overflow lets remote attacker run codeibm mq operatorVendor2026-10-19 17:17 UTCby InfraStack Analyst–WHAT TO DO LOW2.7IBM MQ Operator: authenticated admin can write files outside intended directoryibm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5IBM MQ Operator: crafted consume request lets an authenticated user crash queue manageribm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5IBM MQ Operator: crafted RFH2 header can crash queued pub/subibm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5IBM MQ Operator: crafted multicast messages crash the queue manageribm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO HIGH8.8IBM MQ Operator: authenticated user can crash it or run codeibm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM5.4IBM MQ Operator: crafted client request causes limited denial of serviceibm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5IBM MQ Operator: authenticated MQOPEN offset flaw enables denial of serviceibm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM5.9IBM MQ Operator: oversized queue name length crashes asynchronous clientsibm mq operatorVendor2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM5.8FusionPBX: Dialplan Editor flaw allows remote OS command injectionOther2026-10-19 17:17 UTCby NVD–WHAT TO DO LOW3.7Webkul Aureus ERP: weak password rules in user form allow easier guessingOther2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM5.5Webkul Aureus ERP: composer.json processing leaks sensitive data into debug outputOther2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5JumpServer: template rendering flaw lets remote users inject OS commandsOther2026-10-19 17:17 UTCby NVD–WHAT TO DO CRITICAL9.8Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages…Package2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM6.3AIOHTTP: Pure-Python parser request smugglingaiohttpPackage2026-10-07 01:23 UTCby GitHub Advisories–FIX 3.14.4 LOW2.3AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesaiohttpPackage2026-10-07 01:23 UTCby GitHub Advisories–FIX 3.14.4 MEDIUM6.3AIOHTTP: Absolute-form request targets can spoof Request.schemeaiohttpPackage2026-10-07 01:24 UTCby GitHub Advisories–FIX 3.14.4 HIGH8.2AIOHTTP: File descriptor exhaustion in multipart requestsaiohttpPackage2026-10-07 01:22 UTCby GitHub Advisories–FIX 3.14.4 MEDIUM6.9AIOHTTP: Connector pool exhaustion via Max-Age overflowaiohttpPackage2026-10-07 01:23 UTCby GitHub Advisories–FIX 3.14.4 HIGH8.8IBM MQ Operator: authenticated MQOPEN flaw crashes service or corrupts memoryibm mq operatorVendor2026-10-19 17:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8IBM MQ Operator: malformed message handle properties overflow heap, allowing code executionibm mq operatorVendor2026-10-19 17:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8IBM MQ Operator: heap overflow on malformed MQPUT lets authenticated users run codeibm mq operatorVendor2026-10-19 17:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.6A user can upload export reports with any file contents and specify any contentsArchibusOther2026-10-19 17:17 UTCby InfraStack Analyst–FIX 2025.02 HIGH8.5Web app: DWR request exposes database usernames and passwords to usersArchibusOther2026-10-19 17:17 UTCby InfraStack Analyst–FIX 2025.02 HIGH8.6Unauthenticated DWR request runs workflow rules without authenticationArchibus Web CentralPackage2026-10-19 17:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in…Package2026-10-19 17:17 UTCby NVD–WHAT TO DO HIGH8.8Slims library system: staff SQL injection exposes database contentsslims9_bulianPackage2026-10-19 17:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6PingTools Network Utilities: Watcher Host field runs injected shell commandsPingTools Network UtilitiesOther2026-10-19 17:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.9Management Console stores remote log and keystore passwords in plain textOther2026-10-19 17:17 UTCby NVD–WHAT TO DO MEDIUM5.4ForgeRock client accepts refresh tokens as valid access tokensPackage2026-10-19 17:16 UTCby NVD–WHAT TO DO MEDIUM4.3Carbon console: XML input enables script injection into victims' browsersOther2026-10-19 17:16 UTCby NVD–WHAT TO DO MEDIUM5.3WSO2 Identity Server: login responses reveal which usernames existOther2026-10-19 17:16 UTCby NVD–WHAT TO DO MEDIUM6.5Session-bound tokens survive logout unless token revocation option is enabledOther2026-10-19 17:16 UTCby NVD–WHAT TO DO HIGH8.2SCIM endpoint lets federated users act on same-named local accountsOther2026-10-19 17:16 UTCby NVD–WHAT TO DO LOW2.7Unnamed product: admin-only Expression Language injection with minimal impactOther2026-10-19 17:16 UTCby NVD–WHAT TO DO MEDIUMINCIDENTSupabase: Support Form ErrorsSupabaseVendor2026-10-19 17:13 UTCby status page–WHAT TO DO HIGH8.2aiohttp server lacks an initial request/header timeoutaiohttpPackage2026-10-07 01:23 UTCby GitHub Advisories–FIX 3.14.4 MEDIUM6.3AIOHTTP: Secure attribute not enforced for shared cookieaiohttpPackage2026-10-07 01:23 UTCby GitHub Advisories–FIX 3.14.4 HIGHNOT SCOREDaiohttp: Multiple instances of excessive or unbounded memory/CPU useaiohttpPackage2026-10-19 17:07 UTCby GitHub Advisories–FIX 3.14.4 MEDIUM4.3russh: Unbounded memory allocation in agent protocol server via crafted constraint recordsrusshPackage2026-10-05 06:55 UTCby GitHub Advisories–FIX 0.64.1 LOWNOT SCOREDA russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestrusshPackage2026-10-19 17:06 UTCby GitHub Advisories–FIX 0.64.0 MEDIUM6.1Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTMLmercuryPackage2026-09-11 07:29 UTCby GitHub Advisories–FIX 3.2.11 MEDIUMINCIDENTTwilio: SMS Delivery Delays and Failures between a Subset of Twilio Long Codes and Multiple Networks in ItalyTwilioVendor2026-10-19 16:53 UTCby status page–WHAT TO DO MEDIUMNOT SCOREDagent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeablegithub.com/envoyproxy/ai-gatewayAI agents & MCP2026-10-19 16:53 UTCby GitHub Advisories–FIX 1.2.0-rc1 MEDIUMNOT SCOREDGraphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repographifyyPackage2026-10-19 16:51 UTCby GitHub Advisories–FIX 0.9.70 NOT SCOREDNOT SCOREDCVE-2026-77228 was rejected by its CNA and has no flawOther2026-10-19 16:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-77227 was rejected and withdrawn by its numbering authorityOther2026-10-19 16:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-77225 was rejected by its numbering authority; no flawOther2026-10-19 16:17 UTCby NVD–WHAT TO DO MEDIUM6.4Netskope client: captive portal stays open, enabling rogue access point abuseOther2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH8.2MongoDB PHP driver: crafted BSON input crashes PHP process via stack exhaustionPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH8.7Picomatch: crafted extglob patterns freeze Node.js event loopPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO MEDIUM6.9Crawl4AI: unauthenticated SSRF in Docker API probes internal hostsAI agents & MCP2026-10-19 16:17 UTCby NVD–WHAT TO DO MEDIUM5.3docling-core: crafted document files read arbitrary local imagesPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH8.7@rvf/set-get: prototype pollution via form field lets attackers crash serversPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH8.3crewai-tools: SeleniumScrapingTool lets prompt injection reach internal addressesAI agents & MCP2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH8.4sqlparse: SQL text injects PHP code through unescaped dollar signsPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH8.6NocoBase collection-sql plugin: privileged users can run arbitrary SQLPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH8.8Semaphore UI: task runners can execute commands on the serversemaphoreOther2026-10-19 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.7docTR: unsafe checkpoint loading lets a malicious model file run codePackage2026-10-19 16:17 UTCby NVD–WHAT TO DO MEDIUM5.3GDevelop desktop: crafted project file leaks gd_resource session cookiePackage2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH7.1MikroTik RouterOS: integer overflow in ipt_SAME kernel moduleInfrastructure2026-10-19 16:17 UTCby NVD–WHAT TO DO LOW3.1memmy-agent memory service: unauthenticated admin shutdown endpoint enables denial of serviceAI agents & MCP2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH7.5Criminal-Management-System: SQL injection in officer registration formOther2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH7.5Criminal-Management-System: SQL injection in officer search pageOther2026-10-19 16:17 UTCby NVD–WHAT TO DO CRITICAL9.8Mercury: Unauthenticated Remote Code Execution via /api/kernelsmercuryPackage2026-08-31 08:07 UTCby GitHub Advisories–FIX 3.2.6 CRITICAL10.0Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassmercuryAI agents & MCP2026-08-21 14:23 UTCby GitHub Advisories–FIX 3.2.4 MEDIUM6.9FOSSBilling: guest signup reveals whether an email is a clientPackage2026-09-11 14:00 UTCby NVD–WHAT TO DO MEDIUM6.9FOSSBilling: unauthenticated endpoint reveals whether server files existPackage2026-09-11 13:59 UTCby NVD–WHAT TO DO LOW2.3FOSSBilling: staff account reads and overwrites deactivated module secretsPackage2026-08-23 18:20 UTCby NVD–WHAT TO DO HIGH7.5CLI Bridge: dangling symlink lets file writes escape the workspace rootPackage2026-08-31 13:32 UTCby NVD–WHAT TO DO MEDIUM6.5Camunda Cockpit: inverted permission check exposes all process data to usersPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO CRITICAL9.8Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where…Camunda 71 talkingPackage2026-10-19 16:17 UTCby InfraStack Analyst1talkingFIX 7.24.16 HIGH8.6Camunda: missing authorization lets users read or delete task attachmentsOther2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH7.8hMailServer installer: non-default folder lets local users run code as SYSTEMPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH7.5hMailServer: a crafted loop-count header lets mail flood the serverPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO MEDIUM6.5hMailServer: authenticated users can send mail as any addressPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO HIGH7.5hMailServer: DKIM signing lets outside senders forge mail as hosted domainsPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO MEDIUM6.5hMailServer: Sieve and mail rules let users send mail as any addressPackage2026-10-19 16:17 UTCby NVD–WHAT TO DO CRITICAL9.8PUBLIC EXPLOITSQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints…SLiMS (slims9_bulian)Other2026-10-19 16:17 UTCby InfraStack Analyst–WHAT TO DO CRITICALINCIDENTGitHub: Degraded availability for GitHub Actions, GitHub Pages and WebhooksGitHubVendor2026-10-19 15:49 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vinted-mocked-apis (PyPI)vinted-mocked-apisPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in x294tn (npm)x294tnPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ivzlid (npm)ivzlidPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in zubn7b (npm)zubn7bPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in giu094 (npm)giu094Package2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 8h66ok (npm)8h66okPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ju0oud (npm)ju0oudPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in gtjgd4 (npm)gtjgd4Package2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in j019qc (npm)j019qcPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in lstsyw (npm)lstsywPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in rhlozh (npm)rhlozhPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in oo9fja (npm)oo9fjaPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 1n9lip (npm)1n9lipPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in g23p4g (npm)g23p4gPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in g8ez1y (npm)g8ez1yPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 3gr2dj (npm)3gr2djPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ljem3j (npm)ljem3jPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in rvmbnj (npm)rvmbnjPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in aqj3w7 (npm)aqj3w7Package2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 4p9kgm (npm)4p9kgmPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 3gr841 (npm)3gr841Package2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 8i7pp4 (npm)8i7pp4Package2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in j5opb7 (npm)j5opb7Package2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 5xzkuy (npm)5xzkuyPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 3qamjp (npm)3qamjpPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in noe77e (npm)noe77ePackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in waojpf (npm)waojpfPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in v49yzy (npm)v49yzyPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in f4iomt (npm)f4iomtPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tkacg3 (npm)tkacg3Package2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ysqp68 (npm)ysqp68Package2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in availab-le-alb-um-zip-38895-crimes-of-passion-oeiro-wmybis (npm)availab-le-alb-um-zip-38895-crimes-of-passion-oeiro-wmybisPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mp3-file-zip-d-ownload-10759-grand-prix-ojzwj-auchhw (npm)mp3-file-zip-d-ownload-10759-grand-prix-ojzwj-auchhwPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mp3-file-zip-d-ownload-hypnotize-kpkk0-ygzaqq (npm)mp3-file-zip-d-ownload-hypnotize-kpkk0-ygzaqqPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in alb-um-availa-ble-zip-mp3-file-someone-to-drive-you-home-vbwzp-koufrz (npm)alb-um-availa-ble-zip-mp3-file-someone-to-drive-you-home-vbwzp-koufrzPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in new-al-bum-av-ailable-50924-satta-massagana-rje2z-lfxsfe (npm)new-al-bum-av-ailable-50924-satta-massagana-rje2z-lfxsfePackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mp3-file-zip-d-ownload-challengers-ym2l6-mkqhum (npm)mp3-file-zip-d-ownload-challengers-ym2l6-mkqhumPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in do-wnload-available-20999-ruff-ryders-first-lady-6wp8i-xhznkl (npm)do-wnload-available-20999-ruff-ryders-first-lady-6wp8i-xhznklPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in a-lbum-do-wnload-avai-lable-file-10635-about-to-choke-pzt0k-onnsvp (npm)a-lbum-do-wnload-avai-lable-file-10635-about-to-choke-pzt0k-onnsvpPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in file-alb-um-zip-new-mp3-32338-think-before-you-speak-9znpc-akvcbt (npm)file-alb-um-zip-new-mp3-32338-think-before-you-speak-9znpc-akvcbtPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in down-load-available-zip-now-42301-gloria-tp7wn-dcxkwl (npm)down-load-available-zip-now-42301-gloria-tp7wn-dcxkwlPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ava-ilable-down-load-mp3-today-75491-life-after-youth-hfdu7-yzwkck (npm)ava-ilable-down-load-mp3-today-75491-life-after-youth-hfdu7-yzwkckPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mp3-do-wnload-file-to-day-d-nu951-cjkdsy (npm)mp3-do-wnload-file-to-day-d-nu951-cjkdsyPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in avail-able-albu-m-down-load-almanac-tdedm-bajrnj (npm)avail-able-albu-m-down-load-almanac-tdedm-bajrnjPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in down-lo-ad-now-zip-mp3-390322-the-silver-scream-2-welcome-to-horrorwood-4a2qf-tjkdio (npm)down-lo-ad-now-zip-mp3-390322-the-silver-scream-2-welcome-to-horrorwood-4a2qf-tjkdioPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in alb-um-availa-ble-zip-mp3-file-470287-watch-my-moves-2zscf-aatbzj (npm)alb-um-availa-ble-zip-mp3-file-470287-watch-my-moves-2zscf-aatbzjPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ava-ilable-down-load-mp3-today-5767-all-eyez-on-me-9vh62-ohwdae (npm)ava-ilable-down-load-mp3-today-5767-all-eyez-on-me-9vh62-ohwdaePackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mp3-do-wnload-file-to-day-27091-usa-united-state-of-atlanta-xoisl-pqpsio (npm)mp3-do-wnload-file-to-day-27091-usa-united-state-of-atlanta-xoisl-pqpsioPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in alb-um-availa-ble-zip-mp3-file-31673-finally-1m7lu-usrooy (npm)alb-um-availa-ble-zip-mp3-file-31673-finally-1m7lu-usrooyPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in availab-le-alb-um-zip-101158-the-louder-i-call-the-faster-it-runs-64ggm-khmrzg (npm)availab-le-alb-um-zip-101158-the-louder-i-call-the-faster-it-runs-64ggm-khmrzgPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in a-vailable-al-bum-file-101379-communion-mt1lk-dvshll (npm)a-vailable-al-bum-file-101379-communion-mt1lk-dvshllPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in availab-le-alb-um-zip-2022-482703-broken-hearts-club-bhvqx-hxwudi (npm)availab-le-alb-um-zip-2022-482703-broken-hearts-club-bhvqx-hxwudiPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in down-lo-ad-now-zip-mp3-year-of-the-gentleman-8mpja-vdihqg (npm)down-lo-ad-now-zip-mp3-year-of-the-gentleman-8mpja-vdihqgPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in do-wnload-available-provincial-q7d0i-muzxoj (npm)do-wnload-available-provincial-q7d0i-muzxojPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ava-ilable-down-load-mp3-today-2018-120200-young-sick-camellia-qvg9z-dqpzyh (npm)ava-ilable-down-load-mp3-today-2018-120200-young-sick-camellia-qvg9z-dqpzyhPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in a-lbum-do-wnload-avai-lable-file-playing-the-angel-l9tng-nkbcwn (npm)a-lbum-do-wnload-avai-lable-file-playing-the-angel-l9tng-nkbcwnPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in availab-le-alb-um-zip-56502-interstellar-space-1qv3j-xsmien (npm)availab-le-alb-um-zip-56502-interstellar-space-1qv3j-xsmienPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in do-wnload-available-2016-44937-in-the-magic-hour-xgzaj-txvlft (npm)do-wnload-available-2016-44937-in-the-magic-hour-xgzaj-txvlftPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in availab-le-alb-um-zip-hope-for-men-wmh1o-fjstib (npm)availab-le-alb-um-zip-hope-for-men-wmh1o-fjstibPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in avail-able-albu-m-down-load-9815-young-americans-vygt4-atskbj (npm)avail-able-albu-m-down-load-9815-young-americans-vygt4-atskbjPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in do-wnload-available-the-white-stripes-1-yywrn-pvfqxa (npm)do-wnload-available-the-white-stripes-1-yywrn-pvfqxaPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in down-lo-ad-now-zip-mp3-12737-talking-book-grhl4-lwvpqw (npm)down-lo-ad-now-zip-mp3-12737-talking-book-grhl4-lwvpqwPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in a-vailable-al-bum-file-the-world-wont-end-7io2n-pbncia (npm)a-vailable-al-bum-file-the-world-wont-end-7io2n-pbnciaPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in down-lo-ad-now-zip-mp3-6140-the-ideal-crash-jysrl-jcdvdw (npm)down-lo-ad-now-zip-mp3-6140-the-ideal-crash-jysrl-jcdvdwPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in zip-mp3-a-lbum-do-wnload-new-392999-fantasy-island-wlvf4-bxyvtm (npm)zip-mp3-a-lbum-do-wnload-new-392999-fantasy-island-wlvf4-bxyvtmPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ava-ilable-down-load-mp3-today-35981-saints-and-sinners-mv3po-fqndxw (npm)ava-ilable-down-load-mp3-today-35981-saints-and-sinners-mv3po-fqndxwPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in a-vailable-al-bum-file-2015-39171-harmlessness-khwlm-ihtwah (npm)a-vailable-al-bum-file-2015-39171-harmlessness-khwlm-ihtwahPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in new-al-bum-av-ailable-girls-can-tell-ccfoc-vmqodd (npm)new-al-bum-av-ailable-girls-can-tell-ccfoc-vmqoddPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in alb-um-availa-ble-zip-mp3-file-43838-stories-of-the-years-sslgg-bqfcko (npm)alb-um-availa-ble-zip-mp3-file-43838-stories-of-the-years-sslgg-bqfckoPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in availab-le-alb-um-zip-211740-city-burials-xwcy6-bhxnvc (npm)availab-le-alb-um-zip-211740-city-burials-xwcy6-bhxnvcPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in alb-um-availa-ble-zip-mp3-file-6053-the-specials-giqmz-flbewh (npm)alb-um-availa-ble-zip-mp3-file-6053-the-specials-giqmz-flbewhPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in do-wnload-available-2013-5195-ripley-pine-zoryg-cyvlnz (npm)do-wnload-available-2013-5195-ripley-pine-zoryg-cyvlnzPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mp3-file-zip-d-ownload-48120-lost-nation-road-0cibe-ynawhz (npm)mp3-file-zip-d-ownload-48120-lost-nation-road-0cibe-ynawhzPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in a-lbum-do-wnload-avai-lable-file-2019-138062-i-need-a-new-war-pp6yu-vclmgu (npm)a-lbum-do-wnload-avai-lable-file-2019-138062-i-need-a-new-war-pp6yu-vclmguPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in a-vailable-al-bum-513977-rant-in-e-minor-lybr0-bdhlsb (npm)a-vailable-al-bum-513977-rant-in-e-minor-lybr0-bdhlsbPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in availab-le-alb-um-zip-the-visitor-l1n8t-frzacy (npm)availab-le-alb-um-zip-the-visitor-l1n8t-frzacyPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in avail-able-albu-m-down-load-6807-yo-bum-rush-the-show-tq11q-lqcaye (npm)avail-able-albu-m-down-load-6807-yo-bum-rush-the-show-tq11q-lqcayePackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in zip-mp3-a-lbum-do-wnload-new-67476-what-we-do-egj2h-bgfgzz (npm)zip-mp3-a-lbum-do-wnload-new-67476-what-we-do-egj2h-bgfgzzPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in new-al-bum-av-ailable-131000-eton-alive-qzngy-cjxczf (npm)new-al-bum-av-ailable-131000-eton-alive-qzngy-cjxczfPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in a-vailable-al-bum-file-19105-filles-de-kilimanjaro-4syt9-khnipp (npm)a-vailable-al-bum-file-19105-filles-de-kilimanjaro-4syt9-khnippPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mp3-file-zip-d-ownload-hearts-of-oak-7cyqu-oiygcz (npm)mp3-file-zip-d-ownload-hearts-of-oak-7cyqu-oiygczPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in a-lbum-do-wnload-avai-lable-file-36733-tchamantche-9uiic-rfzaip (npm)a-lbum-do-wnload-avai-lable-file-36733-tchamantche-9uiic-rfzaipPackage2026-10-19 15:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in bs58x64 (npm)bs58x64Package2026-10-19 15:29 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in bs58x64.js (npm)bs58x64.jsPackage2026-10-19 15:29 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in base58x64 (npm)base58x64Package2026-10-19 15:29 UTCby osv-malicious–UNINSTALL MEDIUM6.2Dell Application Installer: sensitive data stored unencrypted, local readers gain accessOther2026-10-19 15:17 UTCby NVD–WHAT TO DO MEDIUM5.3Sensei LMS WordPress plugin: subscribers can message any course authorPackage2026-10-19 15:17 UTCby NVD–WHAT TO DO MEDIUM5.3Sensei LMS WordPress plugin lets teachers modify other teachers' coursesPackage2026-10-19 15:17 UTCby NVD–WHAT TO DO HIGH7.5vraj404 Criminal Management System: SQL injection in home.php submission formOther2026-10-19 15:17 UTCby NVD–WHAT TO DO HIGH7.5Criminal-Management-System: SQL injection in search.php lets remote attackers query dataOther2026-10-19 15:17 UTCby NVD–WHAT TO DO HIGH7.5Criminal-Management-System: unrestricted file upload via home.php my_img argumentOther2026-10-19 15:17 UTCby NVD–WHAT TO DO MEDIUM5.5Octoally: path argument manipulation leaks information from serverAI agents & MCP2026-10-19 15:16 UTCby NVD–WHAT TO DO MEDIUMINCIDENTTwilio: Voice Call Failures from a Subset of Twilio Phone Numbers to PortugalTwilioVendor2026-10-19 15:06 UTCby status page–WHAT TO DO HIGH7.1Qt SVG: deeply nested SVG file crashes applications via stack exhaustionPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO CRITICAL9.8FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote…Package2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM5.4FlyCms: account update lets users overwrite protected account fieldsOther2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM5.3FlyCms: any registered user can alter other users' numeric content fieldsOther2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM5.4BoxyHQ SaaS Starter Kit: team members can manage billing without permissionOther2026-10-19 14:17 UTCby NVD–WHAT TO DO CRITICAL9.8CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read,…checkcle1 talkingPackage2026-10-19 14:17 UTCby InfraStack Analyst1talkingWHAT TO DO MEDIUM6.9Flarum Extension Manager leaks task output to unauthenticated internet visitorsPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM4.7UKIC canary web components: DOM XSS in ic-tree-item labelsPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM5.4Koalixcrm: stored XSS in task titles lets staff create superusersPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO LOW3.3Krayin CRM: webhook SSRF filter bypassed via DNS rebinding to internal hostsPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.1Krayin CRM: scoped users can edit or delete other users' emailsPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.1Krayin CRM: scope-restricted users can read other users' quotesPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM5.3Thelia: coupon usage limits bypassed through pay-later and cancelled ordersRuntime2026-10-18 16:11 UTCby NVD–WHAT TO DO MEDIUM4.8libaribcaption: crafted captions read past a table, leaking memory or crashingPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.8libbluray: crafted disc metadata file exhausts memory and CPUInfrastructure2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.8libbluray: crafted ClipInfo file causes out-of-bounds read and crashPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.9libaribb24: stack overflow in CSI parsing lets crafted captions corrupt memoryPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.9libaribb24: heap overflow in caption parser lets crafted media crash playersPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.1rdesktop: malicious RDP server crashes client via bitmap cache readPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.1rdesktop: malicious RDP server crashes client via heap out-of-bounds readPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.1rdesktop: malformed RDP bitmaps let a hostile server crash clientsrdesktopPackage2026-10-19 14:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9Netpbm: rasttopnm heap over-read leaks adjacent heap memory from crafted rasterfilesPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.9Netpbm: crafted Sun rasterfile input corrupts heap memory in rasttopnmPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.3libtins: out-of-bounds read in DNS SOA parsing crashes or leaks heapPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.9libtins: crafted DNS packet causes one-byte heap out-of-bounds readPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.8libdisplay-info: crafted EDID can read past heap bufferPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.8libdisplay-info: heap out-of-bounds read in DisplayID parser crashes on crafted EDIDInfrastructure2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.1SGLang: unauthenticated staging messages let attackers exhaust prefill memoryAI agents & MCP2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.1SGLang: unauthenticated ZMQ registration floods let attackers crash the schedulerAI agents & MCP2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.3sglang-router: data-plane API key reaches HA admin routes and shutdownAI agents & MCP2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.9SGLang: client-supplied bootstrap fields let unauthenticated callers probe internal hostsAI agents & MCP2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH8.2SGLang: short client request IDs let one client abort others' generationsAI agents & MCP2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH8.3LangBot: unauthenticated forged Lark events drive the LLM pipeline and toolsLangBotAI agents & MCP2026-10-19 14:17 UTCby InfraStack Analyst–FIX 4.11.1 HIGH8.5BentoML: Dockerfile newline injection runs attacker build commands during containerizebentoml1 talkingPackage2026-10-19 14:17 UTCby InfraStack Analyst1talkingWHAT TO DO HIGH8.5Television: crafted filenames with apostrophes run shell commandsPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.1RisingWave: low-privilege SQL users can read and write server filesPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM5.4Surfer SEO WordPress plugin: missing authorization check exposes access controlsPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.4D-Link E15, M32, R15, R32 routers: hard-coded MQTT broker credentials allow remote accessInfrastructure2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.5speaches: model argument lets remote users select code to loadAI agents & MCP2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM5.5Events-Management-System: project.sql flaw exposes files or directories remotelyOther2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH7.5Events-Management-System: missing authentication on unknown endpoints, remotely exploitablePackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM5.1Frappe Helpdesk: portal users can create tickets as other customersPackage2026-09-21 12:18 UTCby NVD–WHAT TO DO MEDIUM5.3Frappe CRM: authenticated Sales Users can alter other users' call logsPackage2026-09-08 07:04 UTCby NVD–WHAT TO DO MEDIUM5.4Frappe CRM: Sales Users can read and change other users' notificationsPackage2026-09-08 07:05 UTCby NVD–WHAT TO DO MEDIUM5.3Sigma File Manager: extension downloads can reach internal addresses via SSRFPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO LOW2.6NoteGen: synced image paths let attackers read local image filesPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.9Mopidy: unauthenticated path traversal reads files outside media directoriesPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO HIGH8.2Yank Note: path traversal lets unauthenticated users read arbitrary server filesPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM5.3KitchenOwl: recipe import lets logged-in users reach internal addressesPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM5.4Locust: cross-site request forgery lets attackers stop load testsPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM6.5WP Mailster WordPress plugin: PHP file inclusion flaw through version 1.9.1.0Package2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM4.3Classified Listing WordPress plugin: input validation flaw exposes restricted functionalityPackage2026-10-19 14:17 UTCby NVD–WHAT TO DO MEDIUM4.3Event Tickets WordPress plugin: authorization bypass via user-controlled keyPackage2026-10-19 14:16 UTCby NVD–WHAT TO DO MEDIUM4.2@fastify/oauth2: OAuth state cookie reuse enables login CSRF attacksPackage2026-10-19 10:14 UTCby NVD–WHAT TO DO MEDIUMINCIDENTOpenAI: File Download errorsOpenAIVendor2026-10-19 13:31 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: Voice Call Failures and Post Dial Delay from a Subset of Twilio Mobile Numbers to BrazilTwilioVendor2026-10-19 13:29 UTCby status page–WHAT TO DO MEDIUM6.1Ellucian Banner Student Registration: XSS via mepCode parameter lets attackers run scriptsVendor2026-10-19 13:16 UTCby NVD–WHAT TO DO MEDIUM6.5GStreamer: crafted ASF file can trigger oversized allocation and crashPackage2026-10-19 13:16 UTCby NVD–WHAT TO DO MEDIUM6.5YITH WooCommerce Wishlist: stored XSS through 4.18.1 lets attackers run scriptsPackage2026-10-19 13:16 UTCby NVD–WHAT TO DO HIGH7.5Events-Management-System: SQL injection in registration delete handler lets attackers read or alter dataPackage2026-10-19 13:16 UTCby NVD–WHAT TO DO HIGH7.5Events-Management-System: SQL injection in doedit.php lets remote users query the databaseOther2026-10-19 13:16 UTCby NVD–WHAT TO DO MEDIUM5.3YITH WooCommerce Product Bundles: missing authorization check through version 2.29.0Package2026-10-19 13:16 UTCby NVD–WHAT TO DO MEDIUM5.3WordPress Broadcast Live Video plugin: missing authorization check through 7.3.7Package2026-10-19 13:16 UTCby NVD–WHAT TO DO MEDIUM4.3FluentCommunity WordPress plugin: missing authorization check through 2.11.0Package2026-10-19 13:16 UTCby NVD–WHAT TO DO MEDIUM5.3FluentForm WordPress plugin: missing authorization check through 6.2.15Package2026-10-19 13:16 UTCby NVD–WHAT TO DO MEDIUM6.5JetElements for Elementor: stored XSS lets page input run scriptsPackage2026-10-19 13:16 UTCby NVD–WHAT TO DO MEDIUM6.5E2Pdf WordPress plugin: stored XSS through versions up to 1.32.57Package2026-10-19 13:16 UTCby NVD–WHAT TO DO MEDIUM5.4LearnPress WordPress plugin: missing authorization lets users bypass access controlPackage2026-10-19 13:16 UTCby NVD–WHAT TO DO HIGH7.4Red Hat ACS: SAML replay lets captured login responses mint new sessionsInfrastructure2026-10-19 13:16 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in array-inline (npm)array-inlinePackage2026-10-19 12:38 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in array-inline-transform (npm)array-inline-transformPackage2026-10-19 12:34 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in dsjklweuvhgsdcq (npm)dsjklweuvhgsdcqPackage2026-10-19 12:24 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mxckjdgweuxpsiohd (npm)mxckjdgweuxpsiohdPackage2026-10-19 12:24 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vjkpwjxbvndelta (npm)vjkpwjxbvndeltaPackage2026-10-19 12:24 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mx3dxhgic8xhd6 (npm)mx3dxhgic8xhd6Package2026-10-19 12:24 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in nsdhjuiwqxmhsf1 (npm)nsdhjuiwqxmhsf1Package2026-10-19 12:24 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ticketcathayoct12 (npm)ticketcathayoct12Package2026-10-19 12:24 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in zxhgssiyluwxchn (npm)zxhgssiyluwxchnPackage2026-10-19 12:24 UTCby osv-malicious–UNINSTALL HIGH8.8Apache Camel camel-jgroups: untrusted serialized messages let attackers run codePackage2026-10-19 12:17 UTCby NVD–WHAT TO DO MEDIUM6.0rhc systemd unit follows symlinks, enabling local root escalation after yggdrasil compromiseInfrastructure2026-10-19 12:17 UTCby NVD–WHAT TO DO HIGH7.5Doctor-Dignity: model_lib argument lets remote attackers inject codellSourcell/Doctor-DignityOther2026-10-19 12:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Online clinic management system: SQL injection in admin document handlerOther2026-10-19 12:17 UTCby NVD–WHAT TO DO MEDIUM5.8Diem CMS: code editor path traversal lets remote users reach arbitrary filesPackage2026-10-19 12:17 UTCby NVD–WHAT TO DO HIGH7.5fastllm: GGUF string parsing overflow lets remote attackers corrupt memoryAI agents & MCP2026-10-19 12:17 UTCby NVD–WHAT TO DO HIGH7.5fastllm: crafted safetensors file overflows buffer during model loadingAI agents & MCP2026-10-19 12:17 UTCby NVD–WHAT TO DO MEDIUMINCIDENTCloudflare: DNS Update DelaysCloudflareVendor2026-10-19 11:28 UTCby status page–WHAT TO DO MEDIUM6.5Apache Camel FOP: XSL-FO body can read local files via XXEPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH8.2Apache Camel: Smooks component reads local files via XML entitiesPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM4.8Apache Camel HTTP: OAuth2 token cache shares tokens across different endpointsPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM4.8Apache Camel: path prefix match turns ordinary HTTP endpoints into proxiesPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.3Apache Camel gRPC: route exception messages leak to calling clientsPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM6.5Apache Camel mail: crafted multipart messages can set mail.smtp headersPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM4.3Apache Camel Jetty: enableCORS grants credentials to every originPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM4.8Apache Camel: untrusted header lets senders join another sagaPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM4.8Apache Camel Keycloak: missing issuer claim skips token validationPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.5Apache Camel PQC: generated private keys written with permissive default permissionsPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM6.5Apache Camel AS2: signing keys shared across requests, wrong partner signs receiptsPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.5Apache Camel MLLP logs patient HL7 data by defaultPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.3Apache Camel CXF: undeclared SOAP faults leak internal class names and stack tracesPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM6.5Apache Camel: header case mismatch lets callers echo headers into responsesPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH7.5Apache Camel HTTP: redirects leak bearer tokens and basic credentials to other hostsPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH7.5Apache Camel: XPath InputSource mode lets XML external entities read filesPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM6.5Apache Camel Tika: parsed document metadata can set Exchange headersPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.9Apache Camel PQC: shared Signature instance lets verification pass uncheckedPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.9Apache Camel Knative: TLS without truststore skips certificate validationPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.3Apache Camel MINA: failed exchanges leak exception details to remote peersPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.9Apache Camel Thrift: shared instance leaks one message's data to othersPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.9Apache Camel PGP: unmarshal skips integrity check on legacy packetsPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.9Apache Camel Shiro: credentials skipped when thread reuses a bound subjectPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.3Apache Camel Knative: failed requests return exception stack traces to callersPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM6.1Apache Camel OAuth callback lets attackers force victims into their loginPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM6.5Apache Camel: Platform HTTP Vert.x CORS handler lets any origin read responsesPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH8.8Apache Camel: dynamic-router control messages let senders run arbitrary expressionsPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH8.2Apache Camel AS2: remote partner can make server connect to any hostPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH8.2Apache Camel Netty HTTP: path case mismatch skips security constraintsPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH8.2Apache Camel: OAuth guard fails open, letting unauthenticated requests reach routesPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH7.4Apache Camel: remote file consumers can read, delete or rename files outside polled directoryPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH7.4Apache Camel SMB: path traversal lets consumers read or delete files outside polled directoryPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH7.4Apache Camel: path traversal in remote file consumers lets attackers read, delete, rename filesPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH7.4Apache Camel FTP: crafted directory listing reads and deletes files outside polled folderPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH8.8Apache Camel Redis: unsafe Java deserialization lets published messages run codePackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH8.2Apache Camel HTTP components: request headers can read config and run bean methodsPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM5.9Apache Camel Docling: string body lets senders fetch URLs or read filesPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO CRITICAL10.0Deserialization of Untrusted Data vulnerability in Apache CamelPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO CRITICAL9.8Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache JohnzonPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM6.3TikTok-Video-Downloader-PHP: improper TLS certificate validation in index.phpPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM6.3GlitterWare Passy: improper TLS certificate validation lets remote attackers intercept trafficPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO HIGH7.5Bandcamp Player: remote control server lacks authentication when enabledOther2026-10-19 11:17 UTCby NVD–WHAT TO DO MEDIUM6.3Fat-Free Framework: HTTP client skips TLS certificate checks in curlPackage2026-10-19 11:17 UTCby NVD–WHAT TO DO CRITICAL9.8Missing authentication for critical function vulnerability in Apache AnswerPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Answer: external login sessions skip suspension checks after account deletionRuntime2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Answer: missing authorization lets users act on non-public contentPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Answer: revoked users keep access to private uploads via stale tokenPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO LOWNOT SCOREDApache Answer: similar-question search leaks metadata of non-public questionsPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Answer: unauthenticated users can read comments on non-public contentPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Answer: hidden question metadata exposed through public answer profilesPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUM4.3Apache Answer: MCP tool leaks hidden or deleted question answers to API key holdersAI agents & MCP2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Answer: missing check exposes invited-user lists of private questionsPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApache Answer: email verification codes accepted across different sensitive workflowsPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO LOWNOT SCOREDApache Answer: unpin permission lets users hide questions without hide rightsPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Answer: imported questions render raw HTML, enabling stored XSSPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO HIGH8.1Apache Answer: full API keys written to logs, enabling credential replayPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUM5.3MISP: module settings lose redacted and cli_only flags, exposing credentialsPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO HIGH7.1MISP: authenticated users can read redacted server secrets via settings lookupPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUM4.8MISP: workflow module page renders service parameter names as raw HTMLPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUM4.8MISP: remote tag colour lets a linked server inject CSSPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO HIGH7.5NLP.js: condition expression pipeline lets remote input inject code@nlpjs/nlpPackage2026-10-19 10:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.0pi-agent-dashboard: WebSocket gateway origin check bypass via cwd argumentAI agents & MCP2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUM6.5DeepPavlov: preprocessor argument injection lets remote attackers run codePackage2026-10-19 10:16 UTCby NVD–WHAT TO DO HIGH8.8Quiz And Survey Master WordPress plugin: object injection lets attackers run codePackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUM6.5Tutor LMS WordPress plugin: stored XSS through 4.1.2 lets scripts runPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO CRITICAL9.9Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG…Package2026-10-19 10:16 UTCby NVD–WHAT TO DO HIGH7.7MapSVG WordPress plugin: path traversal through 8.16.1 exposes server filesPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUM6.4WordPress Essential Addons for Elementor: privilege escalation through incorrect privilege assignmentPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO CRITICAL9.9Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows…Package2026-10-19 10:16 UTCby NVD–WHAT TO DO HIGH7.1Ays Pro Quiz Maker WordPress plugin: reflected XSS through version 6.7.1.91Package2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Kylin: project admin can exhaust resources via cache APIPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApache Kylin: default startup profile omits security settings, weakening deploymentsPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO LOWNOT SCOREDApache Kylin: job manipulation leaks sensitive information to unauthorized usersPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApache Kylin: JDBC source configuration validation flaw, minor unless exposed publiclyPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApache Kylin: SQL injection flaw, moderate impact in query-only modePackage2026-10-19 10:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApache Kylin: unauthenticated broadcast flaw enables unsafe deserialization on exposed serversPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApache Kylin: missing authorization lets users change JDBC source configPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Kylin: SSRF in job service lets attackers reach internal systemsPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApache Kylin: metadata backup deletion can escape its directoryPackage2026-10-19 10:16 UTCby NVD–WHAT TO DO HIGH8.8Integratec application: SQL injection leaks credentials and user data via loginIntegratec applicationOther2026-10-19 09:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.1MISP: deleting an event leaves orphaned threat intelligence records behindPackage2026-10-19 09:17 UTCby NVD–WHAT TO DO MEDIUM5.3MISP: event sync pushes non-exportable tags to remote instances, breaking event savesOther2026-10-19 09:17 UTCby NVD–WHAT TO DO HIGH7.1MISP: proposal visibility check ignores distribution level, exposing shadow attributesPackage2026-10-19 09:17 UTCby NVD–WHAT TO DO HIGH8.5MobaXterm: unverified plugin extraction lets local file swap run codeMobaXterm Personal Edition (Portable)Other2026-10-19 09:17 UTCby InfraStack Analyst–FIX 26.5 HIGH7.5DeepPavlov: config reference resolver flaw allows remote code injectionAI agents & MCP2026-10-19 09:17 UTCby NVD–WHAT TO DO MEDIUM5.1SourceCodester Inventory System: Hsn_Code parameter enables cross-site scriptingOther2026-10-19 09:17 UTCby NVD–WHAT TO DO MEDIUM4.0SourceCodester Inventory System: stored XSS in purchase record fieldsOther2026-10-19 09:17 UTCby NVD–WHAT TO DO MEDIUM4.0SourceCodester Inventory System: stored XSS in product save handlerPackage2026-10-19 09:17 UTCby NVD–WHAT TO DO MEDIUM6.5openGauss: replication auth bypass lets outside hosts read backups and logsRuntime2026-10-19 09:17 UTCby NVD–WHAT TO DO HIGH7.1VOCALOID6 Editor: XML external entities let a crafted project leak dataVOCALOID6 EditorOther2026-10-19 09:17 UTCby InfraStack Analyst–FIX 6.13.3 MEDIUMINCIDENTTwilio: Voice Call Failures from a Subset of Callers to Twilio Denmark Phone NumbersTwilioVendor2026-10-19 09:11 UTCby status page–WHAT TO DO MEDIUM6.5Mini-XML: use-after-free in mxml_load_data lets remote attackers corrupt memoryPackage2026-10-19 08:17 UTCby NVD–WHAT TO DO MEDIUM5.0Online clinic management system: reflected XSS via feedback.php msg parameterOther2026-10-19 08:17 UTCby NVD–WHAT TO DO MEDIUM5.0Online clinic management system: doctor registration page allows cross-site scriptingOther2026-10-19 08:17 UTCby NVD–WHAT TO DO MEDIUM5.5Dairy management system: AJAX endpoint lets remote users read filesOther2026-10-19 08:17 UTCby NVD–WHAT TO DO MEDIUM6.5Dairy management system: SQL injection in payment page lets attackers read databasePackage2026-10-19 08:17 UTCby NVD–WHAT TO DO MEDIUM4.3openGauss: pg_read_binary_file_blocks lets low-privilege users read table dataPackage2026-10-19 08:17 UTCby NVD–WHAT TO DO MEDIUM5.3App Builder WordPress plugin: unauthenticated option write enables visitor redirectsPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM5.3Snap Finance WordPress plugin: unauthenticated users can change WooCommerce order statusPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM5.3TrueBooker WordPress plugin: unauthenticated users can change booking services and pricesPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM5.3TrueBooker WordPress plugin: unauthenticated users can book at any pricePackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM5.3TrueBooker WordPress plugin exposes customer booking details to unauthenticated usersPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM5.3TrueBooker WordPress plugin: anyone can overwrite its configurationPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO LOW3.8Subscribe to Comments WordPress plugin: email header injection via sender namePackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM5.3iPOSpays WooCommerce plugin: unpaid orders can be marked paidPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO HIGH7.2HPE Superdome Flex and Scale-up Server: remote command execution on the RMCInfrastructure2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM5.3Document Gallery WordPress plugin: unauthenticated webhook lets anyone replace thumbnailsPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM6.8WordPress Document Gallery plugin: shortcode attributes allow stored XSSPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO HIGH7.4bootc and ostree: staged deployments skip signature re-check before rebootbootcInfrastructure2026-10-19 07:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.8Dairy-management-system: SQL injection in employee delete page lets remote attackers query the databaseOther2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM6.5Dav-ee dairy-management-system: SQL injection in farmers/add.php form fieldsPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM6.5itsourcecode Online Cake Ordering System: SQL injection in confirm.php cancel parameterOther2026-10-19 07:16 UTCby NVD–WHAT TO DO LOW3.7Salon Booking System WordPress plugin: negative booking totals via discount codePackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM5.3BDM Digital Payment Gateway WordPress plugin: anyone can mark orders paidPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MEDIUM5.3WooCommerce Coinbase plugin accepts forged payment webhooks when secret is unsetPackage2026-10-19 07:16 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in zeroz-baileys (npm)zeroz-baileysPackage2026-10-19 06:27 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in prastzyy (npm)prastzyyPackage2026-10-19 06:23 UTCby osv-malicious–UNINSTALL MEDIUM5.3Snap Finance WordPress plugin: unpaid WooCommerce orders can be marked as paidPackage2026-10-19 06:17 UTCby NVD–WHAT TO DO MEDIUM5.3ElementsReady Addons for Elementor: unauthenticated users download paid WooCommerce filesPackage2026-10-19 06:17 UTCby NVD–WHAT TO DO MEDIUM4.3ElementsReady Addons for Elementor: subscribers can overwrite stored plugin settingsPackage2026-10-19 06:17 UTCby NVD–WHAT TO DO MEDIUM5.3FormFlow for GoHighLevel WordPress plugin exposes log file with access tokenPackage2026-10-19 06:17 UTCby NVD–WHAT TO DO MEDIUM4.3HPE Scale-up Server and Superdome Flex: remote RMC filesystem listing and modificationInfrastructure2026-10-19 06:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDbootc: CVE-2026-16487 rejected, not a vulnerability per Red HatInfrastructure2026-10-19 06:17 UTCby NVD–WHAT TO DO HIGH7.5ESPnet: model inference handler deserializes attacker-controlled _target_ argumentPackage2026-10-19 06:17 UTCby NVD–WHAT TO DO MEDIUM5.5SGLang: weight exporter group_name argument allows remote denial of servicesglangAI agents & MCP2026-10-19 06:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8SGLang: remote requests to expert-distribution endpoint cause denial of servicesglangAI agents & MCP2026-10-19 06:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM7.5HanLP: model config loading lets a remote caller trigger deserializationhanlpPackage2026-10-19 06:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9SME Server: domain creation lets admins corrupt Apache config, blocking web startupInfrastructure2026-10-19 06:17 UTCby NVD–WHAT TO DO HIGH7.7SME Server: path traversal in View Logs leaks files unauthenticatedSME ServerInfrastructure2026-10-19 06:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.8Blaze Demo Importer WordPress plugin: uploaded SVG runs JavaScript in visitors' browsersPackage2026-10-19 06:17 UTCby NVD–WHAT TO DO MEDIUM5.3ActiveTrail for WooCommerce plugin lets anyone create free WooCommerce couponsPackage2026-10-19 06:17 UTCby NVD–WHAT TO DO MEDIUM5.3WordPress Vantiv gateway plugin accepts forged payment notifications, marking orders paidPackage2026-10-19 06:17 UTCby NVD–WHAT TO DO HIGH7.5Llama-Chinese: adapter config argument allows remote code injectionAI agents & MCP2026-10-19 05:17 UTCby NVD–WHAT TO DO HIGH7.5HanLP: unsafe deserialization in word2vec vocab loader enables remote codePackage2026-10-19 05:17 UTCby NVD–WHAT TO DO HIGH7.5RVC WebUI: manipulated ckpt_path argument lets remote attackers inject codeAI agents & MCP2026-10-19 05:17 UTCby NVD–WHAT TO DO MEDIUM6.3radare2: HTTP sandbox default lets remote /cmd requests run processesPackage2026-10-19 05:17 UTCby NVD–WHAT TO DO MEDIUM5.6MeTube: feed-metadata thumbnail fetch allows server-side request forgeryPackage2026-09-29 17:29 UTCby NVD–WHAT TO DO HIGH7.5Unsloth: unsafe class selection in sentence transformer loader allows code executionPackage2026-10-19 04:17 UTCby NVD–WHAT TO DO HIGH7.5Tencent ncnn: integer overflow in YUV-to-RGB conversion, remote triggerPackage2026-10-19 04:17 UTCby NVD–WHAT TO DO HIGH7.5Tencent ncnn: out-of-bounds read in MatMul layer during matrix multiplicationPackage2026-10-19 04:17 UTCby NVD–WHAT TO DO MEDIUM5.5donetick: history deletion lets users remove chores not assigned to themPackage2026-10-19 04:17 UTCby NVD–WHAT TO DO HIGH7.0openGauss JDBC driver: logger class name loads arbitrary classes on clientPackage2026-10-19 04:17 UTCby NVD–WHAT TO DO HIGH7.5dotnet eShop: Catalog API flaw allows improper authentication remotelyPackage2026-10-19 03:16 UTCby NVD–WHAT TO DO MEDIUM6.5Cal.com: webhook creation flaw lets remote users bypass authorizationPackage2026-10-19 03:16 UTCby NVD–WHAT TO DO MEDIUM4.0Diem CMS: dmWidget link tag text lets remote attackers inject scriptsPackage2026-10-19 03:16 UTCby NVD–WHAT TO DO HIGH8.1openGauss: crafted packed HLL input overflows server heap in HllObjectUnpackRuntime2026-10-19 03:16 UTCby NVD–WHAT TO DO CRITICAL9.3Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP…google/sam (Agent Mesh)AI agents & MCP2026-09-06 16:01 UTCby InfraStack Analyst–FIX 0.1.0-alpha.9 CRITICAL9.3Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http…AI agents & MCP2026-09-04 06:09 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @fmr-ap149494/apex-base-component (npm)@fmr-ap149494/apex-base-componentPackage2026-10-19 03:11 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @fcsmc/commercial-analytics (npm)@fcsmc/commercial-analyticsPackage2026-10-19 03:01 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: SMS Delivery Receipt Delays from Twilio to Surf Telecom BrazilTwilioVendor2026-10-19 02:41 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in fabdeploycheck (PyPI)fabdeploycheckPackage2026-10-19 02:26 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in fabtoolkit (PyPI)fabtoolkitPackage2026-10-19 02:26 UTCby osv-malicious–UNINSTALL LOW3.7diem PHP: dmString::random uses a cryptographically weak PRNGPackage2026-10-19 02:17 UTCby NVD–WHAT TO DO MEDIUM5.0diem: sign-in Referer parameter enables open redirect attacksPackage2026-10-19 02:17 UTCby NVD–WHAT TO DO LOW3.3diem: reflected cross-site scripting in administrative console command parameterPackage2026-10-19 02:17 UTCby NVD–WHAT TO DO LOW3.3diem: XSS in the admin version check page via dmAdminCtrl.jsOther2026-10-19 02:17 UTCby NVD–WHAT TO DO LOW3.7diem: Google Analytics client skips certificate validation, allowing interceptionPackage2026-10-19 02:17 UTCby NVD–WHAT TO DO HIGH7.5GeoWebServer.exe: default web server ports carry an unspecified flawOther2026-10-19 02:17 UTCby NVD–WHAT TO DO CRITICAL9.8A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exeGV-ASManagerInfrastructure2026-10-19 02:17 UTCby InfraStack Analyst–FIX 6.4.0 MEDIUM5.0MuPDF: double free in signature locking lets a crafted PDF crash or run codePackage2026-10-19 01:16 UTCby NVD–WHAT TO DO MEDIUM6.5iWebShop 5: weak password recovery lets remote users reach other accountsOther2026-10-19 01:16 UTCby NVD–WHAT TO DO MEDIUM5.0iWebShop-5: login redirect parameter enables open redirect to attacker sitesPackage2026-10-19 01:16 UTCby NVD–WHAT TO DO MEDIUM5.0iWebShop-5: password change form accepts cross-site forged requestsOther2026-10-19 01:16 UTCby NVD–WHAT TO DO MEDIUM5.8iWebShop-5: SQL injection in search utility lets remote users query the databasePackage2026-10-19 00:16 UTCby NVD–WHAT TO DO MEDIUM4.0Chamilo LMS: ticket project name field allows cross-site scriptingPackage2026-10-19 00:16 UTCby NVD–WHAT TO DO MEDIUM6.5Diem: default password in data loader lets remote attackers inPackage2026-10-19 00:16 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwindcss-keyframe-kit (npm)tailwindcss-keyframe-kitPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwindcss-animate-catalog (npm)tailwindcss-animate-catalogPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-kinetic (npm)tailwind-kineticPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animatecss-tailwind-vectrix (npm)animatecss-tailwind-vectrixPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animatecss-tailwind-plugin (npm)animatecss-tailwind-pluginPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animatecss-tailwind-luminary (npm)animatecss-tailwind-luminaryPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-keyframes (npm)tailwind-keyframesPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-animatecss-kit (npm)tailwind-animatecss-kitPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animatecss-tailwind-binary (npm)animatecss-tailwind-binaryPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animatecss-tailwind-presets (npm)animatecss-tailwind-presetsPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animatecss-tailwind-helper (npm)animatecss-tailwind-helperPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-animaflow-kit (npm)tailwind-animaflow-kitPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwindcss-effect-lab (npm)tailwindcss-effect-labPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-animate-kit (npm)tailwind-animate-kitPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwindcss-visual-kit (npm)tailwindcss-visual-kitPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwindcss-animatemotion (npm)tailwindcss-animatemotionPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-fabric (npm)tailwind-fabricPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in signalledger-bridge (npm)signalledger-bridgePackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animate-twcss-pack (npm)animate-twcss-packPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwindcss-motionanimate (npm)tailwindcss-motionanimatePackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animatecss-tailwind-graphic (npm)animatecss-tailwind-graphicPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-animationlab (npm)tailwind-animationlabPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-css-keyframes (npm)tailwind-css-keyframesPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animate-twcss-bridge (npm)animate-twcss-bridgePackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in animate-tailwind-kit (npm)animate-tailwind-kitPackage2026-10-19by osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in signalledger-diagnostics (npm)signalledger-diagnosticsPackage2026-10-19by osv-malicious–UNINSTALL

Sunday, Oct 18Monday, Oct 19Tuesday, Oct 20