CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

DEBIAN-CVE-2026-55768

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum...

CLEANSTART-2026-IN49367 Security fixes in grafana-alloy 1.15.0-r0

Package grafana-alloy version 1.15.0-r0 fixes 18 vulnerabilities: CVE-2026-34040, CVE-2026-33997, CVE-2026-34165, CVE-2026-33762, CVE-2026-34986...

CLEANSTART-2026-BJ59269 Security fixes in elastic-beats 8.18.1-r0

Package elastic-beats version 8.18.1-r0 fixes 4 vulnerabilities: ghsa-p77j-4mvh-x3m3, ghsa-4vq8-7jfc-9cvp, CVE-2025-54410, CVE-2026-33186...

CLEANSTART-2026-RF73854 Security fixes in keda 2.18.3-r0

Package keda version 2.18.3-r0 fixes 6 vulnerabilities: CVE-2026-26958, CVE-2025-68156, CVE-2026-24051, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr...

CLEANSTART-2026-RO94854 Security fixes in cert-manager-fips 1.18.3-r0

Package cert-manager-fips version 1.18.3-r0 fixes 3 vulnerabilities: CVE-2025-47913, CVE-2025-58181, CVE-2025-47914...

CLEANSTART-2026-RH87819 Security fixes in modelmesh-runtime-adapter 0.12.0-r1

Package modelmesh-runtime-adapter version 0.12.0-r1 fixes 18 vulnerabilities: CVE-2025-58187, CVE-2025-58188, CVE-2025-61723, CVE-2025-61725, CVE-2025-47912...

CVE-2026-65883 Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...

CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-53667

React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs...

CVE-2026-53669 React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0...

EUVD-2026-49634

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-55685 React Router: Unauthenticated Denial of Service via Inefficient Route Matching

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-55685 React Router: Unauthenticated Denial of Service via Inefficient Route Matching

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-55685

React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React...

CVE-2026-53667 React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)

React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs...

CVE-2026-66428

Unauthenticated Cross Site Request Forgery CSRF in WP Google Review Slider = 18.4 versions...

EUVD-2026-49240

Administrator SQL Injection in WP Google Review Slider = 18.4 versions...

PT-2026-65324

Name of the Vulnerable Software and Affected Versions Kali Forms versions 2.4.18 and earlier Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations Update Kali Forms to a...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2003)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2003 advisory. In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK CVE-2026-64600 Tenable has extracted the preceding description block directly...