io.quarkiverse.renarde:quarkus-renarde (>=3.0.13, <=3.0.20), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.0.13, <=3.0.20) +14 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.9.0.cr1, <=3.20.6.1)

io.quarkus:quarkus-rest-csrf MAVEN version =3.9.0.cr1, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.20 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

io.quarkiverse.renarde:quarkus-renarde (>=3.1.4, <=3.1.6), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.4, <=3.1.6) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-rest-csrf MAVEN version =3.28.0.cr1, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.28.0.cr1, =3.33.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

io.quarkus:quarkus-rest-csrf-deployment (3.37.0.cr1) potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (3.37.0.cr1)

io.quarkus:quarkus-rest-csrf MAVEN version 3.37.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-rest-csrf and may be impacted: - io.quarkus:quarkus-rest-csrf-deployment 3.37.0.cr1 Source cves: CVE-2026-50559 Source advisory:...

EUVD-2026-37199

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands e.g. system reboot...

CVE-2026-22313

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying...

CVE-2026-22312

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands e.g. system reboot...

Deserialization of Untrusted Data

Overview langgraph-checkpoint is a library with base interfaces for LangGraph checkpoint savers. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonPlusSerializer while reconstructing Python objects from JSON checkpoint payloads. An attacker can...

CVE-2026-22313 OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying...

BIT-MYSQL-CLIENT-2026-44170 MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP...

BIT-MARIADB-MIN-2026-44170 MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP...

BIT-MARIADB-2026-44170 MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP...

PT-2026-49827

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The device features a webserver that exposes a REST API authenticated via a token on the management network. An authenticated attacker can exploit an OS command...

PT-2026-49831

Name of the Vulnerable Software and Affected Versions Real Testimonials Pro affected versions not specified Product Slider Pro for WooCommerce affected versions not specified Smart Post Show Pro affected versions not specified Description A supply chain compromise occurred where attackers...

CVE-2026-22312: Use of Hard-coded Credentials

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands e.g. system reboot...

CVE-2026-22313: Improper Neutralization of Special Elements used in an OS Command

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying...

CVE-2026-8386

The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address...

XXE Injection

Spring REST Docs is vulnerable to XML External Entity XXE Injection. The vulnerability is due to unsafe processing of XML content when documenting remote APIs, where a compromised or malicious API can supply crafted XML containing external entities. When documentation-generating tests are execute...

CVE-2026-8386 WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID

The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address...

EUVD-2026-36698

The WP Go Maps WordPress plugin before 10.0.10 does not perform any approval-state filtering on its public single-marker REST endpoint, allowing unauthenticated users to retrieve marker records that an administrator has not yet approved for public display, including any PII placed in the address...

CVE-2026-12207

A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID...