CVE-2026-0947 AT Internet Piano Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-004

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting XSS.This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1...

CVE-2026-24884

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can caus...

GHSA-5W5R-8XC6-2XHW Apache Answer Exposure of Private Personal Information to an Unauthorized Actor vulnerability

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized users to retrieve restricted o...

EUVD-2026-5384

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or...

CVE-2026-24735 Apache Answer: Revision API Improper Access Control leads to Information Disclosure

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or...

compressing 后置链接漏洞

Compressing is a compression and decompression tool library open source from nodemodules. Compressing versions 1.10.3 and earlier, as well as version 2.0.0, have a backlink vulnerability. This vulnerability arises from not verifying the symbolic link targets when extracting TAR archives, which ma...

GHSA-CC8F-XG8V-72M3 Compressing Vulnerable to Arbitrary File Write via Symlink Extraction

Arbitrary File Write via Symlink Extraction in github.com/node-modules/compressing Brief Introduction The compressing npm package extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an...

boltz 安全漏洞

Boltz is an official repository for a biological model developed by Jeremy Wohlwend as a personal project. Version 2.0.0 of Boltz contains a security vulnerability; this vulnerability stems from the use of Python pickle to deserialize molecular data files without proper verification, which could...

PT-2026-6414

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achie...

@activepieces/piece-snowflake (>=0.2.1, <=0.3.0), @bhanu17/nextjs-starter (>=1.2.0, <=2.2.14) +95 more potentially affected by CVE-2026-3449 via @tootallnate/once (2.0.0)

@tootallnate/once NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @tootallnate/once and may be impacted: - @activepieces/piece-snowflake =0.2.1, =1.2.0, =0.0.18, =0.2.0, =0.0.6, =0.0.1, =50.32.5-depup.0, =0.6.0, =0.4.2, =0.1.10,...

EUVD-2025-206437

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting XSS.This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1...

Burp Global Match and Replace Extension 2.0.0

This archive provides a system-wide match and replace table that applies to all Burp tools including Burp AI. This goes beyond Proxy Match and Replace, which only affects Proxy...

Gila CMS security vulnerability

Gila CMS is a set of open-source content management systems CMS developed by Gila CMS Inc., based on PHP and MySQL. Versions of Gila CMS prior to 2.0.0 contained security vulnerabilities; these vulnerabilities stemmed from unvalidated HTTP headers, which could allow unauthorized attackers to...

AZL-76505 CVE-2026-0994 affecting package pytorch for versions less than 2.0.0-14

A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can...

CVE-2026-24627

Missing Authorization vulnerability in Trusona Trusona for WordPress trusona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trusona for WordPress: from n/a through = 2.0.0...

CVE-2026-24604 WordPress Simple GDPR Cookie Compliance plugin <= 2.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in themebeez Simple GDPR Cookie Compliance simple-gdpr-cookie-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple GDPR Cookie Compliance: from n/a through = 2.0.0...

CVE-2026-24565

Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects B Accordion: from n/a through = 2.0.0...

Security Bulletin: A vulnerability in Apache common-beanutils affects IBM Db2 Big SQL on Cloud Pak for Data

Summary A vulnerability in Apache common-beanutils 1.9.4 affects IBM Db2 Big SQL 8.2 on Cloud Pak for Data 5.2 and earlier. Vulnerability Details CVEID:CVE-2025-48734 DESCRIPTION: Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2...

PT-2026-4438

Name of the Vulnerable Software and Affected Versions themebeez Simple GDPR Cookie Compliance versions through 2.0.0 Description An issue exists in themebeez Simple GDPR Cookie Compliance where incorrectly configured access control security levels can be exploited, leading to a missing...

WordPress plugin B Accordion has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...