ara-cli (>=0.1.14.13, <=0.1.14.14), auto-browse (>=0.0.2, <=0.0.5) +32 more potentially affected by CVE-2026-107295 via pydantic-ai (>=1.34.0, <=1.107.2)

pydantic-ai PYPI version =1.34.0, =0.1.14.13, =0.0.2, =1.34.0, =1.0.0, =1.0.0, =0.1.102, =26.0.0, =0.2.0, =0.1.0, =0.1.71, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-107295 Source advisory: OSV:GHSA-H4XC-3QFQ-JF93...

clai (>=1.77.0, <=1.107.5), compas-lca (>=1.0.0, <=1.0.2) +20 more potentially affected by CVE-2026-107290 via pydantic-ai (>=1.77.0, <=1.107.5)

pydantic-ai PYPI version =1.77.0, =1.77.0, =1.0.0, =1.1.0, =0.1.102, =26.1.0, =0.2.0, =26.1.0rc1, =0.9.1, =1.2.2 - murmur-runtime 0.1.0 - open-aura 0.1.0 - opsmith-cli 0.4.6b0 and more Source cves: CVE-2026-107290 Source advisory: GHSA-FPF4-VWCP-V4HP...

ara-cli (>=0.1.14.13, <=0.1.14.14), clai (>=1.56.0, <=1.107.5) +32 more potentially affected by CVE-2026-107289 via pydantic-ai (>=1.56.0, <=1.107.5)

pydantic-ai PYPI version =1.56.0, =0.1.14.13, =1.56.0, =1.0.0, =1.0.0, =0.1.102, =26.1.0, =0.2.0, =0.1.0, =0.1.71, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-107289 Source advisory: SNYK:PYTHON-PYDANTICAI-20848913...

CVE-2026-106611

Cross-Site Request Forgery CSRF vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3...

CVE-2026-106611 WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3...

EUVD-2026-94955

Cross-Site Request Forgery CSRF vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3...

CVE-2026-106611

The WPMU DEV Forminator plugin (versions n/a through 1.57.3 ) is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is associated with CWE-352 and has a High base sever...

EUVD-2026-91667

Next.js has information disclosure in development server's Model Context Protocol endpoint...

EUVD-2026-91673

Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass...

CVE-2026-96335

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2...

CVE-2026-96335 WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2...

CVE-2026-96335 WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2...

CVE-2026-96335

The Forminator WordPress plugin (versions

GHSA-R5MF-4R5X-Q78F Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Summary The error page that Quasar CLI shows when an SSR or SSG render throws in development serializes every variable in process.env, every request header and every cookie into the HTTP response, and the dev server binds 0.0.0.0 by default. Any host that can reach the port therefore gets the...

CVE-2026-103075

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...

ROOT-APP-NPM-GHSA-P3F5-W63M-MXPH GHSA-p3f5-w63m-mxph in webpack-dev-middleware - Patched by Root

Root has patched GHSA-p3f5-w63m-mxph in the webpack-dev-middleware package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-76844 CVE-2026-76844 in webpack-dev-middleware - Patched by Root

Root has patched CVE-2026-76844 in the webpack-dev-middleware package for Root:npm. Multiple fixed versions available...

CVE-2026-103075 WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...

PT-2026-107454

Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2...