CVE-2026-41425 Authlib: Cross-site request forging when using cache

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starletteclient.OAuth. This vulnerability is fixed in 1.6.11...

CVE-2026-41421 SiYuan Desktop Notification XSS Leads to Electron RCE

SiYuan is an open-source personal knowledge management system. Prior to 3.6.5, SiYuan desktop renders notification messages as raw HTML inside an Electron renderer. The notification route POST /api/notification/pushMsg accepts a user-controlled msg value, forwards it through the backend broadcast...

Security Bulletin: Platform Navigator in IBM Cloud Pak for Integration is vulnerable to vulnerability in Elliptic

Summary Platform Navigator in IBM Cloud Pak for Integration is vulnerable to vulnerability in Elliptic. CVE-2025-14505 The vulnerability have been addressed Vulnerability Details CVEID:CVE-2025-14505 DESCRIPTION: The ECDSA implementation of the Elliptic package generates incorrect signatures if a...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in Lodash

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to vulnerability in Lodash. CVE-2025-13465 The vulnerability have been addressed. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash versions 4.0.0 through 4.17.22 are vulnerable to...

airflow-clickhouse-plugin (1.2.0), airflow-tools (>=0.8.5, <=0.9.1) +2 more potentially affected by CVE-2026-38743 via apache-airflow (2.8.4)

apache-airflow PYPI version 2.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.2.0 - airflow-tools =0.8.5, =0.0.4, =2.4.0rc1, =2.5.1 Source cves: CVE-2026-38743 Source advisory:...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (1.3.0) +2 more potentially affected by CVE-2026-41044 via org.apache.activemq:apache-activemq (5.0.0)

org.apache.activemq:apache-activemq MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:apache-activemq and may be impacted: - org.apache.axis2:axis2-integration 1.4 - org.apache.camel:camel-example-cxf 1.3.0 -...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (1.3.0) +2 more potentially affected by CVE-2026-41044 via org.apache.activemq:apache-activemq (5.0.0)

org.apache.activemq:apache-activemq MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:apache-activemq and may be impacted: - org.apache.axis2:axis2-integration 1.4 - org.apache.camel:camel-example-cxf 1.3.0 -...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (>=1.2.0, <=1.3.0) +3 more potentially affected by CVE-2026-41043 via org.apache.activemq:apache-activemq (>=4.1.1, <=5.0.0)

org.apache.activemq:apache-activemq MAVEN version =4.1.1, =1.2.0, =1.1.0, =1.3.0 - org.apache.camel:camel-example-spring 1.2.0 - org.apache.camel:camel-example-spring-xquery 1.3.0 Source cves: CVE-2026-41043 Source advisory: MEND:CVE-2026-41043...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (>=1.2.0, <=1.3.0) +3 more potentially affected by CVE-2026-40466 via org.apache.activemq:apache-activemq (>=4.1.1, <=5.0.0)

org.apache.activemq:apache-activemq MAVEN version =4.1.1, =1.2.0, =1.1.0, =1.3.0 - org.apache.camel:camel-example-spring 1.2.0 - org.apache.camel:camel-example-spring-xquery 1.3.0 Source cves: CVE-2026-40466 Source advisory: MEND:CVE-2026-40466...

PT-2026-35087

Name of the Vulnerable Software and Affected Versions langchain-openai versions prior to 1.1.14 Description The url to size helper function, utilized by get num tokens from messages for image token counting, contains a Time-of-Check to Time-of-Use TOCTOU flaw. The function validates URLs for...

PT-2026-35065

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.6.5 Description SiYuan desktop renders notification messages as raw HTML within an Electron renderer. The API endpoint '/api/notification/pushMsg' accepts a user-controlled msg value, which is forwarded through the...

WordPress plugin ExactMetrics has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

LangChain code-related vulnerabilities

LangChain is an open-source framework developed by LangChain for creating applications powered by large language models LLMs. Versions of LangChain prior to 1.1.14 contained code vulnerabilities. These vulnerabilities stemmed from the urltosize helper function in langchain-openai, which, after...

PT-2026-34850

The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get ads access token and reset experience AJAX handlers. While the mi-admin-nonce is...

WordPress plugin BetterDocs has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

cve

cve.sh — CVE Discovery & Exploitation Reporter Technology f...

cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names

A flaw was found in the Go programming language golang and its command-line tool cmd/go. A remote attacker could exploit this during the build process by crafting malicious SWIG Simplified Wrapper and Interface Generator file names that contain "cgo" and specific payloads. This could lead to code...

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 13, 2026 to April 19, 2026)

Last week, there were 139 vulnerabilities disclosed in 118 WordPress Plugins and 10 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 85 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

EUVD-2026-25117

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integrations including webhook URLs, create new...

Oracle Siebel Server <= 26.1 (April 2026 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by a vulnerability as referenced in the April 2026 CPU advisory. - Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: Open Integration Snappy. Supported versions that are affected are...