warehouse 授权问题漏洞

Warehouse is a small-scale warehouse logistics management system developed by Yeqifu’s individual developer, based on Spring Boot. There are authorization issues in Warehouse; these issues stem from incorrect operations in the component Notice Management, specifically in the file...

PT-2026-6914

Name of the Vulnerable Software and Affected Versions yeqifu warehouse versions prior to aaf29962ba407d22d991781de28796ee7b4670e4 Description A flaw exists within the Notice Management component of yeqifu warehouse, specifically in the addNotice, updateNotice, deleteNotice, and batchDeleteNotice...

CVE-2026-1769 Stored XSS on Xerox CentreWare Web 7.0.6

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Xerox CentreWare on Windows allows Stored XSS.This issue affects CentreWare: through 7.0.6. Consider upgrading Xerox® CentreWare Web® to v7.2.2.25 via the software available on Xerox.com...

Malicious Package

Overview syf-typings is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Fedora 42 : openqa (2026-84de1534b1)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-84de1534b1 advisory. This update bumps the bundled lodash to 4.17.23 to ensure openQA is protected against CVE-2025-13465. It likely was not vulnerable in any case, though, as I...

CVE-2026-24985 WordPress WP Forms Signature Contract Add-On plugin <= 1.8.2 - Broken Access Control to Notice Dismissal vulnerability

Missing Authorization vulnerability in approveme WP Forms Signature Contract Add-On wp-forms-signature-contract-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Forms Signature Contract Add-On: from n/a through = 1.8.2...

CVE-2026-24985 WordPress WP Forms Signature Contract Add-On plugin <= 1.8.2 - Broken Access Control to Notice Dismissal vulnerability

Missing Authorization vulnerability in approveme WP Forms Signature Contract Add-On wp-forms-signature-contract-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Forms Signature Contract Add-On: from n/a through = 1.8.2...

CVE-2026-24985

The CVE-2026-24985 entry describes a Missing Authorization/Broken Access Control vulnerability in the approveme WP Forms Signature Contract Add-On for WordPress, affecting versions up to and including 1.8.2. The issue stems from incorrectly configured access control security levels, enabling unau...

PT-2026-5763

Name of the Vulnerable Software and Affected Versions ingress-nginx affected versions not specified Description A denial of service condition exists in the validating admission controller feature. Sending large requests to the validating admission controller can lead to excessive memory...

CGA-83RC-62W8-XX72

Bulletin has no description...

CGA-6MXF-Q4G9-45XF

Bulletin has no description...

CGA-2692-PR8W-GRXC

Bulletin has no description...

Mageia: Security Advisory (MGASA-2026-0026)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-1588 jishenghua jshERP installByPath install path traversal

A vulnerability was found in jishenghua jshERP up to 3.6. The impacted element is the function install of the file /jshERP-boot/plugin/installByPath of the component com.gitee.starblues.integration.operator.DefaultPluginOperator. The manipulation of the argument path results in path traversal. It...

CGA-HCC6-93J3-G877

Bulletin has no description...

GHSA-9JWR-P39P-HWG2 vulnerabilities

Vulnerabilities for packages: nodejs...

CVE-2025-68902

creationtimestamp| type| source ---|---|--- 2026-01-27 23:29:39+00:00| seen| Telegram/zJvFOg6c3xK9qMq2DX4vkBVjAi9k0P0w4NQCJGGQFKnl2g8...

CVE-2025-69054

creationtimestamp| type| source ---|---|--- 2026-01-27 17:26:11+00:00| seen| Telegram/MruT4zr3HDjAavow11whz2OZvcarBdRDLsNpY1B7JokuVE...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the adminorownerrequired function in avatarview.py. An attacker can alter other users' profile images by sending crafted requests while authenticated with standard user privileges...

openSUSE Security Advisory (SUSE-SU-2026:0254-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...