CVE-2025-11159: Dependency on Vulnerable Third-Party Component

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site Scripting issue in Analytics dashboard chart rendering impacts GitLab EE Cross-site Scripting issue in global search impacts GitLab CE/EE Cross-site Scripting issue in Duo Agent output rendering impacts GitLab EE Cross-site Scripting issue in Analytics Dashboard impacts...

cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names

A flaw was found in the Go programming language golang and its command-line tool cmd/go. A remote attacker could exploit this during the build process by crafting malicious SWIG Simplified Wrapper and Interface Generator file names that contain "cgo" and specific payloads. This could lead to code...

CVE-2026-5371

The MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnerable through missing capability checks on get_ads_access_token() and reset_experience() in all versions up to 10.1.2. The issue allows authenticated attackers with Subscriber-lev...

CVE-2026-5371 MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset

The MonsterInsights – Google Analytics Dashboard for WordPress Website Stats Made Easy plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability checks on the getadsaccesstoken and resetexperience functions in all versions up to, and including,...

CVE-2026-5371 MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset

The MonsterInsights – Google Analytics Dashboard for WordPress Website Stats Made Easy plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability checks on the getadsaccesstoken and resetexperience functions in all versions up to, and including,...

io.sniffy:sniffy-integration-tests-tomcat (>=3.1.10, <=3.1.14), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.107) +2 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (7.0.107)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.107 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.sniffy:sniffy-integration-tests-tomcat =3.1.10, =3.15.3, =3.16.8 Source...

io.sniffy:sniffy-integration-tests-tomcat (>=3.1.10, <=3.1.14), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.107) +2 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (7.0.107)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.107 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.sniffy:sniffy-integration-tests-tomcat =3.1.10, =3.15.3, =3.16.8 Source...

io.sniffy:sniffy-integration-tests-tomcat (>=3.1.10, <=3.1.14), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.107) +2 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (7.0.107)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.107 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.sniffy:sniffy-integration-tests-tomcat =3.1.10, =3.15.3, =3.16.8 Source...

com.amazonaws:aws-dynamodb-session-tomcat (2.0.4), org.apache.tomcat:tomcat-catalina-ha (8.0.1) +3 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (8.0.1)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.amazonaws:aws-dynamodb-session-tomcat 2.0.4 - org.apache.tomcat:tomcat-catalina-ha 8.0.1 ...

com.ovea.tajin.server:tajin-server-jetty8 (>=1.0.b1, <=1.0.b11), com.ovea.tajin.server:tajin-server-jetty9 (>=1.0.b1, <=1.0.b11) +10 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (7.0.8)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.ovea.tajin.server:tajin-server-jetty8 =1.0.b1, =1.0.b1, =4.7.1, =3.2.1, =1.2.0.beta1,...

com.ovea.tajin.server:tajin-server-jetty8 (>=1.0.b1, <=1.0.b11), com.ovea.tajin.server:tajin-server-jetty9 (>=1.0.b1, <=1.0.b11) +10 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (7.0.8)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.ovea.tajin.server:tajin-server-jetty8 =1.0.b1, =1.0.b1, =4.7.1, =3.2.1, =1.2.0.beta1,...

com.spatineo:geoserver-tomcat8-valve (1.0), org.apache.tomcat:tomcat-catalina-ha (8.5.46) +10 more potentially affected by CVE-2026-41284 via org.apache.tomcat:tomcat-catalina (8.5.46)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.46 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.spatineo:geoserver-tomcat8-valve 1.0 - org.apache.tomcat:tomcat-catalina-ha 8.5.46 -...

CVE-2026-42303

Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was...

KB5090408 - Description of the security update for SQL Server 2019 GDR: May 12, 2026

None None...

KB5091158 - Description of the security update for SQL Server 2022 GDR: May 12, 2026

None None...

KB5089900 - Description of the security update for SQL Server 2022 CU24: May 12, 2026

None None...

KB5089899 - Description of the security update for SQL Server 2025 CU4: May 12, 2026

None None...

WordPress WP Google Maps Integration plugin <= 1.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Julian Chibuike Nwadinobi Wackydawg - streamio in WordPress Plugin WP Google Maps Integration versions = 1.2...

EUVD-2026-29415

The WP Google Maps Integration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...