GHSA-9J54-FG26-WV3R vulnerabilities

Vulnerabilities for packages: semgrep, kserve, ggshield, superset, py3-cassandra-medusa, open-webui, datadog-agent...

GHSA-P4G4-X82P-Q773 vulnerabilities

Vulnerabilities for packages: semgrep, kserve, ggshield, superset, py3-cassandra-medusa, open-webui, datadog-agent...

CVE-2026-101917 vulnerabilities

Vulnerabilities for packages: semgrep, kserve, ggshield, superset, py3-cassandra-medusa, open-webui, datadog-agent...

CVE-2026-101883

The OpenClaw Windows Node versions through 2026.9.4 are vulnerable to a Server-Side Request Forgery (SSRF) flaw within the canvas.present capability. The root cause is that canvas.present allows for the bypass of URL risk evaluations normally enforced by canvas.navigate . An attacker possessing g...

CVE-2026-55494

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

CVE-2026-55494

The Tugtainer application (prior to version 1.30.4 ) is vulnerable to unauthenticated access to Docker management APIs because the agent/auth.py signature verification function incorrectly returns successfully when Config.AGENT_SECRET is empty. This flaw allows attackers to bypass authentication ...

CVE-2026-55494 Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

EUVD-2026-90193

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

CVE-2026-55494 Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

CVE-2026-55494 Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENTSECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py,...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

0xtrails (>=0.0.0-20251106131028, <=0.18.6), 123pancli (1.0.0) +5780 more potentially affected by CVE-2026-101899 via axios (>=1.15.0, <=1.19.0)

axios NPM version =1.15.0, =0.0.0-20251106131028, =0.1.1, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 an...

0xtrails (>=0.0.0-20251106131028, <=0.18.6), 123pancli (1.0.0) +5780 more potentially affected by CVE-2026-101899 via axios (>=1.15.0, <=1.19.0)

axios NPM version =1.15.0, =0.0.0-20251106131028, =0.1.1, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 an...

CVE-2026-100263

JetBrains YouTrack versions prior to 2026.2.18991 are vulnerable to stored HTML injection . The vulnerability is triggered through the User-Agent header , allowing for the injection of malicious HTML content. The impact is categorized as Medium severity, with a CVSS score of 4.7 . Remediation is ...

CVE-2026-100263

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

EUVD-2026-90007

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

0xtrails (>=0.0.0-20251106131028, <=0.18.6), 123pancli (1.0.0) +5780 more potentially affected by CVE-2026-101906 via axios (>=1.15.0, <=1.19.0)

axios NPM version =1.15.0, =0.0.0-20251106131028, =0.1.1, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 an...

0xtrails (>=0.0.0-20251106131028, <=0.18.6), 123pancli (1.0.0) +4555 more potentially affected by CVE-2026-101909 via axios (>=1.15.1, <=1.19.0)

axios NPM version =1.15.1, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 and more...

Exploit for CVE-2026-97347

CVE-2026-97347 — Stored XSS in Post Views Stats Counter WordP...

CVE-2026-97347

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...