Insecure Default Initialization of Resource

Overview @storybook/core-server is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved project config...

@asherng/storybook (>=1.0.6, <=1.0.15), @asng/storybook (>=0.0.0-AddSnapshotPipeline-20240326102812, <=0.0.10) +27 more potentially affected by CVE-2026-114126 via @storybook/core-server (>=8.0.0, <=8.6.14)

@storybook/core-server NPM version =8.0.0, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =1.1.1-beta.3, =0.2.36, =8.1.2, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.2.0-alpha.10 and more Source cves: CVE-2026-114126 Source advisory: GHSA-PX85-F4Q5-JH77...

@asherng/storybook (>=1.0.6, <=1.0.15), @asng/storybook (>=0.0.0-AddSnapshotPipeline-20240326102812, <=0.0.10) +27 more potentially affected by CVE-2026-114126 via @storybook/core-server (>=8.0.0, <=8.6.14)

@storybook/core-server NPM version =8.0.0, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =1.1.1-beta.3, =0.2.36, =8.1.2, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.2.0-alpha.10 and more Source cves: CVE-2026-114126 Source advisory:...

@asherng/storybook (>=1.0.6, <=1.0.15), @asng/storybook (>=0.0.0-AddSnapshotPipeline-20240326102812, <=0.0.10) +27 more potentially affected by CVE-2026-114126 via @storybook/core-server (>=8.0.0, <=8.6.14)

@storybook/core-server NPM version =8.0.0, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =1.1.1-beta.3, =0.2.36, =8.1.2, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.2.0-alpha.10 and more Source cves: CVE-2026-114126 Source advisory: OSV:GHSA-PX85-F4Q5-JH...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/core-server is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, which does not validate the origin of...

@asherng/storybook (>=1.0.6, <=1.0.15), @asng/storybook (>=0.0.0-AddSnapshotPipeline-20240326102812, <=0.0.10) +27 more potentially affected by CVE-2026-114125 via @storybook/core-server (>=8.0.0, <=8.6.14)

@storybook/core-server NPM version =8.0.0, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =1.1.1-beta.3, =0.2.36, =8.1.2, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.2.0-alpha.10 and more Source cves: CVE-2026-114125 Source advisory: OSV:GHSA-F2PH-CMG5-WX...

@asherng/storybook (>=1.0.6, <=1.0.15), @asng/storybook (>=0.0.0-AddSnapshotPipeline-20240326102812, <=0.0.10) +27 more potentially affected by CVE-2026-114125 via @storybook/core-server (>=8.0.0, <=8.6.14)

@storybook/core-server NPM version =8.0.0, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =1.1.1-beta.3, =0.2.36, =8.1.2, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.2.0-alpha.10 and more Source cves: CVE-2026-114125 Source advisory: GHSA-F2PH-CMG5-WXC8...

@asherng/storybook (>=1.0.6, <=1.0.15), @asng/storybook (>=0.0.0-AddSnapshotPipeline-20240326102812, <=0.0.10) +27 more potentially affected by CVE-2026-114125 via @storybook/core-server (>=8.0.0, <=8.6.14)

@storybook/core-server NPM version =8.0.0, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =1.1.1-beta.3, =0.2.36, =8.1.2, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.2.0-alpha.10 and more Source cves: CVE-2026-114125 Source advisory:...

@asherng/storybook (>=1.0.6, <=1.0.15), @asng/storybook (>=0.0.0-AddSnapshotPipeline-20240326102812, <=0.0.10) +27 more potentially affected by CVE-2026-114125 via @storybook/core-server (>=8.0.0, <=8.6.14)

@storybook/core-server NPM version =8.0.0, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =1.1.1-beta.3, =0.2.36, =8.1.2, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.2.0-alpha.10 and more Source cves: CVE-2026-114125 Source advisory: MEND:CVE-2026-114125...

CLSA-2026-1792442135 TuxCare security update for @storybook/core-server (1 CVE)

TuxCare rebuilt @storybook/core-server to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

Incorrect Authorization

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Incorrect Authorization in the user role edit validation logic in ghost/core/core/server/models/user.js, where the authorization check for role assignment is skipped when a user edits another user's profil...

Core Oracle WebLogic Server Privilege Escalation

Уязвимость компонента Core сервера приложений Oracle WebLogic Server связана с недостатками процедуры аутентификации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить полный контроль над приложением с использованием сетевого HTTP-протокола...

Core server component Unauthorized Access

The vulnerability of the Core server component of Oracle HTTP Server is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to the device through HTTP requests...

CVE-2026-8109

An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials...

CVE-2026-6902: Improper Control of Generation of Code

A Remote Code Execution vulnerability in P4 Helix Core Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks...

Vulnerabilities managed in Ivanti Endpoint Manager

Ivanti has addressed several vulnerabilities in Ivanti Endpoint Manager, specifically in the core server, the agent, and the web console components. These vulnerabilities concern various aspects of Ivanti Endpoint Manager. First, a remotely authenticated attacker can exploit a vulnerable method t...

Vulnerability in core server (CVE-2026-6478)

PostgreSQL discloses MD5-hashed passwords via covert timing channel Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all...

Vulnerability in core server (CVE-2026-6472)

PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use searchpath to find user-defined types, including extension-defined types. That is to say, the victim will execute...

EUVD-2026-29489

An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials...

CVE-2026-8109

An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials...