Malicious Package

Overview daytonjs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2026-27457

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet weblate/api/views.py, line 2831 uses queryset = Addon.objects.all without overriding getqueryset to scope results by user permissions. This allows any authenticated user or anonymous users if REQUIRELOG...

EUVD-2025-208142

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system and views it, the embedded JavaScript payload can...

Malicious Package

Overview @skyzopedia/baileys-mod is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

CVE-2026-2751 Blind SQL Injection

Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux Service Dependencies modules allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24...

org.keycloak:keycloak-authz-policy-common (8.0.0), org.keycloak:keycloak-authz-policy-drools (8.0.0) +14 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (8.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 8.0.0 -...

org.keycloak:keycloak-authz-policy-common (3.0.0.final), org.keycloak:keycloak-authz-policy-drools (3.0.0.final) +11 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (3.0.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 3.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 3.0.0.final -...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.3), com.github.vzakharchenko:cisco-radius-plugin (1.4.3) +32 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (17.0.1)

org.keycloak:keycloak-server-spi-private MAVEN version 17.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.3 -...

org.keycloak:keycloak-authz-policy-common (10.0.0), org.keycloak:keycloak-dependencies-server-all (10.0.0) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (10.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 10.0.0 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-common (3.1.0.final) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (3.1.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

org.keycloak:keycloak-authz-policy-common (2.5.1.final), org.keycloak:keycloak-authz-policy-drools (2.5.1.final) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.5.1.final)

org.keycloak:keycloak-server-spi-private MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.5.1.final -...

CVE-2026-1442

Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker or anyone paying attention, the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models...

CVE-2026-1442 Unitree UPK files Hard-Coded Key

Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker or anyone paying attention, the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models...

PT-2026-22294

Name of the Vulnerable Software and Affected Versions Unitree Go2 and other models versions affected versions not specified Description The encryption algorithm used to protect firmware updates is encrypted using key material accessible to attackers. This allows unauthorized modification of...

btrfs add_all_parents Heap Buffer Overflow DoS

The vulnerability of the addallparents function in the fs/btrfs/backref.c file of the btrfs file system in the Linux kernel is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-25220

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Message Center accepts the URL parameter showall=yes and passes it to getPnotesByUser, which returns all internal messages all users’ notes. The backend does not...

CVE-2026-27457 Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet weblate/api/views.py, line 2831 uses queryset = Addon.objects.all without overriding getqueryset to scope results by user permissions. This allows any authenticated user or anonymous users if REQUIRELOG...

CVE-2026-27457 Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet weblate/api/views.py, line 2831 uses queryset = Addon.objects.all without overriding getqueryset to scope results by user permissions. This allows any authenticated user or anonymous users if REQUIRELOG...

CVE-2026-27457 Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet weblate/api/views.py, line 2831 uses queryset = Addon.objects.all without overriding getqueryset to scope results by user permissions. This allows any authenticated user or anonymous users if REQUIRELOG...

CVE-2026-27457

Weblate CVE-2026-27457 records a missing access control in the AddonViewSet: before 5.16.1, the REST API uses Addon.objects.all() without proper get_queryset scoping, allowing any authenticated user (or anonymous if REQUIRE_LOGIN is not set) to list or retrieve all addons across projects via GET ...