OPENSUSE-SU-2026:10194-1 cargo-audit-advisory-db-20260213-1.1 on GA media

These are all security issues fixed in the cargo-audit-advisory-db-20260213-1.1 package on the GA media of openSUSE Tumbleweed...

📄 Xerte Online Toolkits 3.14 Upload Image Shell Upload

This Metasploit module exploits the user template file import functions unrestricted file upload in Xerte Online Toolkits versions 3.14 and earlier to upload and execute a shell. This targets editor/uploadImage.php. This has only been tested in implementations where the authentication type is Db...

Server-Side Request Forgery (SSRF)

NocoDB is vulnerable to a Server-Side Request Forgery SSRF. The vulnerability is due to an unprotected HEAD request in the uploadViaURL functionality, which allows an attacker to trigger limited outbound requests to arbitrary URLs before SSRF validation is enforced...

GHSA-VHVQ-FV9F-WH4Q LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic

Description A malformed or tampered-with LookupResources Cursor token can cause a panic in the SpiceDB process if it fails to parse. If an attacker were able to make requests to a SpiceDB instance, they could affect its availability. Reproduction If one was to take a cursor from a LookupResources...

@ainsleydev/payload-helper (>=0.0.6, <=0.1.2), @davincicoding/payload-plugin-kit (0.0.4) +9 more potentially affected by CVE-2026-25544 via @payloadcms/db-sqlite (>=3.0.0-beta.116, <=3.72.0)

@payloadcms/db-sqlite NPM version =3.0.0-beta.116, =0.0.6, =1.1.10, =1.2.0 - payload-smart-deletion 1.0.7 - simple-shop 1.0.0 Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDBSQLITE-15240188...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +3 more potentially affected by CVE-2026-25544 via @payloadcms/db-postgres (>=3.0.0-beta.135, <=3.61.0)

@payloadcms/db-postgres NPM version =3.0.0-beta.135, =0.0.6, =1.0.0, =0.0.9-alpha.5, =0.0.9-alpha.58 - payload-auth-plugin 0.7.5 Source cves: CVE-2026-25544 Source advisory: SNYK:JS-PAYLOADCMSDBPOSTGRES-15240187...

@n8n/backend-test-utils (0.26.0), @n8n/db (0.34.0) +2 more potentially affected by CVE-2026-25051 via n8n-core (1.122.0)

n8n-core NPM version 1.122.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-core and may be impacted: - @n8n/backend-test-utils 0.26.0 - @n8n/db 0.34.0 - @n8n/task-runner 1.59.0 - n8n-node-dev 1.121.0 Source cves: CVE-2026-25051 Source advisory:...

SolarView Compact 6.00 - 'pow' Cross-Site Scripting

SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'pow' parameter to SolarSlideSub.php. id: CVE-2022-29301 info: name: SolarView Compact 6.00 - 'pow' Cross-Site Scripting author: For3stCo1d severity: high description: | SolarView Compact version 6.00 contains a...

SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting

SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'timebegin' parameter to SolarHistory.php. id: CVE-2022-29299 info: name: SolarView Compact 6.00 - 'timebegin' Cross-Site Scripting author: For3stCo1d severity: medium description: | SolarView Compact version 6.00...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, cri-tools, fluxcd-kustomize-mutating-webhook, paranoia, cilium-cli, headlamp, rancher-system-agent, src-fingerprint, ghaudit, crossplane-provider-aws-cloudfront, kubernetes-csi-driver-nfs, kubernetes-csi-external-attacher, vault-k8s,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: paranoia, src-fingerprint, vault-k8s, crossplane-provider-aws-cloudfront, minio-operator, crossplane-provider-aws-iam, boring-registry, rancher-system-upgrade-controller, slsa-verifier, mkcert, k8sgateway, hivemind, crossplane-provider-aws-dynamodb,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: local-static-provisioner, cri-tools, fluxcd-kustomize-mutating-webhook, paranoia, esbuild, cilium-cli, headlamp, rancher-system-agent, src-fingerprint, ghaudit, crossplane-provider-aws-cloudfront, kubernetes-csi-driver-nfs, kubernetes-csi-external-attacher, vault-k8s...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: paranoia, src-fingerprint, vault-k8s, crossplane-provider-aws-cloudfront, minio-operator, crossplane-provider-aws-iam, boring-registry, rancher-system-upgrade-controller, slsa-verifier, mkcert, k8sgateway, hivemind, crossplane-provider-aws-dynamodb,...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, cri-tools, fluxcd-kustomize-mutating-webhook, paranoia, cilium-cli, headlamp, rancher-system-agent, src-fingerprint, ghaudit, crossplane-provider-aws-cloudfront, kubernetes-csi-driver-nfs, kubernetes-csi-external-attacher, vault-k8s,...

EUVD-2026-4868

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting XSS vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline...

WordPress Elementor Contact Form DB plugin <= 2.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by You Ludwig in WordPress Plugin Elementor Contact Form DB versions = 2.1.3...

Malicious code in primebeem-db (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9f1198676da63547b3cee3d253b405d8e3dede154ddbe5ea600ae12bd9f5d1 The package primebeem-db was found to contain malicious code. Source: ghsa-malware 12f10893865523e5ced704d651ea8f536db02fb4352114b3c243b7978e237254 A...

Malicious Package

Overview @nayzak51/primebeem-db is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious code in @nayzak51/primebeem-db (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eda80707c579faf8880cabeefa8ebf20fb33b076337d64cb93a3ebf6e210e29b The package @nayzak51/primebeem-db was found to contain malicious code. Source: ghsa-malware...

NocoDB security vulnerabilities

NocoDB is an open-source alternative to Airtable. It converts any MySQL, PostgreSQL, SQL Server, SQLite, and MariaDB databases into intelligent spreadsheets. Versions of NocoDB prior to 0.301.0 contained a security vulnerability. This vulnerability stemmed from a prototype pollution issue in...