CVE-2026-32887: Concurrent Execution using Shared Resource with Improper Synchronization

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. Prior to version 3.20.0, when using RpcServer.toWebHandler or HttpApp.toWebHandlerRuntime inside a Next.js App Router route handler, any Node.js AsyncLocalStorage-dependent...

PT-2026-26194

H3 NodeRequestUrl bugs Vulnerable pieces of code : js import H3, serve, defineHandler, getQuery, getHeaders, readBody, defineNodeHandler from "h3"; let app = new H3 const internalOnly = defineHandlerevent, next = const token = event.headers.get"x-internal-key"; if token !==...

@studiocms/migrator (>=0.1.0-beta.1, <=0.2.1), @withstudiocms/auth-kit (>=0.1.0-beta.1, <=0.1.3) +2 more potentially affected by CVE-2026-32638 via @withstudiocms/effect (>=0.1.0, <=0.3.0)

@withstudiocms/effect NPM version =0.1.0, =0.1.0-beta.1, =0.1.0-beta.1, =0.1.0-beta.1, =0.1.0-beta.25, =0.3.0 Source cves: CVE-2026-32638 Source advisory: SNYK:JS-WITHSTUDIOCMSEFFECT-15682415...

@studiocms/migrator (>=0.1.0-beta.1, <=0.2.1), @withstudiocms/auth-kit (>=0.1.0-beta.1, <=0.1.3) +2 more potentially affected by CVE-2026-32103 via @withstudiocms/effect (>=0.1.0, <=0.3.0)

@withstudiocms/effect NPM version =0.1.0, =0.1.0-beta.1, =0.1.0-beta.1, =0.1.0-beta.1, =0.1.0-beta.25, =0.3.0 Source cves: CVE-2026-32103 Source advisory: SNYK:JS-WITHSTUDIOCMSEFFECT-15627226...

@withstudiocms/api-spec (>=0.3.0, <=0.3.1), @withstudiocms/effect (0.4.0) +1 more potentially affected by CVE-2026-32103 via effectify (0.1.1)

effectify NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on effectify and may be impacted: - @withstudiocms/api-spec =0.3.0, =0.4.0, =0.4.3 Source cves: CVE-2026-32103 Source advisory: SNYK:JS-EFFECTIFY-15627223...

CVE-2026-28432

Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled o...

CVE-2026-28275

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API...

GNSS SpAmming: A Spoofing-Based GNSS Denial-Of-Service Attack

GNSSs are vulnerable to attacks of two kinds: jamming i.e. denying access to the signal and spoofing i.e. impersonating a legitimate satellite. These attacks have been extensively studied, and we have a myriad of countermeasures to mitigate them. In this paper we expose a new type of attack:...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Typer Effect vulnerability discovered by Webbernaut in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.2.37...

CVE-2025-59103

The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the devices, it was noticed that there are two users...

d2m-apigen (>=1.0.1, <=2.1.7), dm-apigen (>=0.0.0, <=1.0.0) +3 more potentially affected by CVE-2026-24132 via @orval/mock (>=7.0.0, <=7.19.0)

@orval/mock NPM version =7.0.0, =1.0.1, =0.0.0, =1.2.0, =7.0.0, =7.1.0, =7.13.2 Source cves: CVE-2026-24132 Source advisory: OSV:GHSA-F456-RF33-4626...

WordPress AJS Footnotes plugin cross-site scripting vulnerability

WordPress AJS Footnotes plugin is a plugin for WordPress designed to add aesthetically pleasing footnote features to posts or pages. The WordPress AJS Footnotes plugin suffers from a cross-site scripting vulnerability that stems from the lack of valid filtering and escaping of notelistclass and...

BELL-CVE-2025-68805

Bulletin has no description...

CVE-2025-15378 AJS Footnotes <= 1.0 - Unauthenticated Stored Cross-Site Scripting

The AJS Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notelistclass' and 'popupdisplayeffectin' parameters in all versions up to, and including, 1.0 due to missing authorization and nonce verification on settings save, as well as insufficient input...

d2m-apigen (>=1.0.1, <=2.1.7), orval (>=7.9.0, <=7.17.2) +1 more potentially affected by CVE-2026-22785 via @orval/mcp (>=7.9.0, <=7.17.2)

@orval/mcp NPM version =7.9.0, =1.0.1, =7.9.0, =7.9.0, =7.13.2 Source cves: CVE-2026-22785 Source advisory: OSV:GHSA-MWR6-3GP8-9JMJ...

d2m-apigen (>=1.0.1, <=2.1.7), orval (>=7.9.0, <=7.17.2) +1 more potentially affected by CVE-2026-22785 via @orval/mcp (>=7.9.0, <=7.17.2)

@orval/mcp NPM version =7.9.0, =1.0.1, =7.9.0, =7.9.0, =7.13.2 Source cves: CVE-2026-22785 Source advisory: SNYK:JS-ORVALMCP-14928070...

CVE-2025-68867

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Based XSS.This issue affects Effect Maker: from n/a through = 1.2.1...

CVE-2023-40605

Auth. contributor Cross-Site Scripting XSS vulnerability in 93digital Typing Effect plugin = 1.3.6 versions...

CVE-2025-68867

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Based XSS.This issue affects Effect Maker: from n/a through = 1.2.1...

CVE-2025-68867 WordPress Effect Maker plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Based XSS.This issue affects Effect Maker: from n/a through = 1.2.1...