org.apache.dubbo:dubbo-compatible (>=3.2.0-beta.6, <=3.3.0-beta.1), org.apache.dubbo:dubbo-remoting-http (>=3.2.0-beta.6, <=3.3.0-beta.1) +4 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.5.87)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.87 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.dubbo:dubbo-compatible =3.2.0-beta.6, =3.2.0-beta.6, =3.2.0-beta....

com.alibaba:dubbo (2.6.0), com.alibaba:dubbo-remoting-http (>=2.6.1, <=2.6.2) +7 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.0.11)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.alibaba:dubbo 2.6.0 - com.alibaba:dubbo-remoting-http =2.6.1, =2.6.1,...

org.apache.dubbo:dubbo-compatible (>=3.2.0-beta.6, <=3.3.0-beta.1), org.apache.dubbo:dubbo-remoting-http (>=3.2.0-beta.6, <=3.3.0-beta.1) +4 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.87)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.87 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.dubbo:dubbo-compatible =3.2.0-beta.6, =3.2.0-beta.6, =3.2.0-beta....

ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0, <=4.6.0), ai.platon.pulsar:pulsar-it-tests (>=4.5.0, <=4.7.4) +1901 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.21)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.10.9 and more Source cves: CVE-2026-41284 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-16643259...

EUVD-2026-29438

Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required...

CVE-2026-7428

Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required...

EUVD-2026-29407

The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permissioncallback of 'returntrue', which bypasses all...

EUVD-2026-29394

The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.7. This is due to the plugin exposing a REST API endpoint /wp-json/ipospays/v1/savesettings with 'permissioncallback' set to 'returntrue', which allows unauthenticated access...

CVE-2026-4663

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been...

CVE-2026-7428 Insecure default administrative credentials in AlloyDB for PostgreSQL

Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required...

CVE-2026-7428

CVE-2026-7428 affects Google Cloud AlloyDB for PostgreSQL. The vulnerability stems from insecure default administrative credentials that could be created by well-intended Terraform or REST API users before 2025-11-03, enabling a remote attacker to gain full administrative access to the database. ...

CVE-2026-7428

Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required...

CVE-2026-4663

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...

CVE-2026-6708

The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permissioncallback of 'returntrue', which bypasses all...

Malicious code in @mesadev/rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 388ca6def3456a442ad932d90bb9732118d37d14ad0ac829d1806103e7aff202 The package @mesadev/rest was found to contain malicious code. Source: ghsa-malware b7f0d4cd50a4af49f5499cbe10e56291c9513bc01541e408f04c2662aabb17e0...

MAL-2026-3510 Malicious code in @mesadev/rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 388ca6def3456a442ad932d90bb9732118d37d14ad0ac829d1806103e7aff202 The package @mesadev/rest was found to contain malicious code. Source: ghsa-malware b7f0d4cd50a4af49f5499cbe10e56291c9513bc01541e408f04c2662aabb17e0...

CVE-2026-6708: Missing Authorization

The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permissioncallback of 'returntrue', which bypasses all...

PT-2026-40441

PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions...

CVE-2026-33570: Incorrect Authorization

PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions...

CVE-2026-26289: Incorrect Authorization

PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only...