CVE-2026-19980

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.updatelangs of the component Language Update. Performing ...

EUVD-2026-60040

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.updatelangs of the component Language Update. Performing ...

CVE-2026-19980 GL.iNet XE3000 Language Update ui.update_langs code injection

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.updatelangs of the component Language Update. Performing ...

CVE-2026-19980

GL.iNet devices (A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, XE3000) up to 4.8.x are affected by a vulnerability in the Language Update component (ui.update_langs). Manipulating the hour/min/week argument results ...

PT-2026-76697

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

Malicious code in fastly-vcl-language-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...

MINI-2MP3-2VJ8-JPPR

Bulletin has no description...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: extism, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, grafana-mimir, aws-nuke, nri-nginx, mattermost,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: extism, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, grafana-mimir, aws-nuke, nri-nginx, mattermost,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: extism, docker-machine-driver-harvester, nri-elasticsearch, nri-kafka, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, grafana-mimir, aws-nuke, nri-nginx, mattermost,...

CVE-2026-56859 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, aws-nuke, mattermost, pombump, redis-operator, loki, external-dns, haproxy-ingress, opentofu,...

GO-2026-6088 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, aws-nuke, mattermost, pombump, redis-operator, loki, external-dns, haproxy-ingress, opentofu,...

CVE-2026-56860 vulnerabilities

Vulnerabilities for packages: extism, docker-machine-driver-harvester, nri-elasticsearch, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, grafana-mimir, aws-nuke, nri-nginx, mattermost, redis-operator, lok...

GO-2026-6218 vulnerabilities

Vulnerabilities for packages: extism, docker-machine-driver-harvester, nri-elasticsearch, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, cert-manager-webhook-pdns, vault-env, crossplane-provider-aws-kms, grafana-mimir, aws-nuke, nri-nginx, mattermost, redis-operator, lok...

CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware middleware/realip.go. The realIP function reads client-controlled headers True-Client-IP, X-Real-IP, and X-Forwarded-For and overwrites r.RemoteAddr without verifying that the request originated from a trusted...

Expression Language Injection

Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...

GO-2026-4803 vulnerabilities

Vulnerabilities for packages: minio...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: aws-fsx-csi-driver-fips, commercial-expanso-edge, cass-operator-fips, azure-service-operator-fips, flux, apm-server, crossplane-provider-terraform, azuredisk-csi-fips, gcp-compute-persistent-disk-csi-driver-fips, hubble-ui-backend-fips, kserve-rest-proxy,...

GO-2023-1765 vulnerabilities

Vulnerabilities for packages: aactl, pulumi-language-java...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, flux, jitsucom-bulker, velero-plugin-for-microsoft-azure, helm-docs, azuredisk-csi-fips, gcp-compute-persistent-disk-csi-driver-fips, linkerd2, kube-rbac-proxy-fips, temporal-ui-server, flux-image-automation-controller-fips,...