16062 matches found
com.51degrees:geo-location.web.examples.mvc (>=4.4.26, <=4.4.28), com.51degrees:geo-location.web.examples.servlet (>=4.4.26, <=4.4.28) +7 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (8.5.98)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.98 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.51degrees:geo-location.web.examples.mvc =4.4.26, =4.4.26, =4.4.26,...
org.apache.dubbo:dubbo-compatible (>=3.2.0-beta.6, <=3.3.0-beta.1), org.apache.dubbo:dubbo-remoting-http (>=3.2.0-beta.6, <=3.3.0-beta.1) +4 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (8.5.87)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.87 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.dubbo:dubbo-compatible =3.2.0-beta.6, =3.2.0-beta.6, =3.2.0-beta....
org.apache.dubbo:dubbo-compatible (>=3.2.0-beta.6, <=3.3.0-beta.1), org.apache.dubbo:dubbo-remoting-http (>=3.2.0-beta.6, <=3.3.0-beta.1) +4 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (8.5.87)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.87 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.dubbo:dubbo-compatible =3.2.0-beta.6, =3.2.0-beta.6, =3.2.0-beta....
com.alibaba:dubbo (2.6.0), com.alibaba:dubbo-remoting-http (>=2.6.1, <=2.6.2) +7 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.0.11)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.alibaba:dubbo 2.6.0 - com.alibaba:dubbo-remoting-http =2.6.1, =2.6.1,...
org.apache.dubbo:dubbo-compatible (>=3.2.0-beta.6, <=3.3.0-beta.1), org.apache.dubbo:dubbo-remoting-http (>=3.2.0-beta.6, <=3.3.0-beta.1) +4 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.87)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.87 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.dubbo:dubbo-compatible =3.2.0-beta.6, =3.2.0-beta.6, =3.2.0-beta....
ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0, <=4.6.0), ai.platon.pulsar:pulsar-it-tests (>=4.5.0, <=4.7.4) +1901 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m1, <=11.0.21)
org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.10.9 and more Source cves: CVE-2026-41284 Source advisory: SNYK:JAVA-ORGAPACHETOMCATEMBED-16643259...
EUVD-2026-29438
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required...
CVE-2026-7428
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required...
EUVD-2026-29407
The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permissioncallback of 'returntrue', which bypasses all...
EUVD-2026-29394
The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.7. This is due to the plugin exposing a REST API endpoint /wp-json/ipospays/v1/savesettings with 'permissioncallback' set to 'returntrue', which allows unauthenticated access...
CVE-2026-4663
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been...
CVE-2026-7428 Insecure default administrative credentials in AlloyDB for PostgreSQL
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required...
CVE-2026-7428
CVE-2026-7428 affects Google Cloud AlloyDB for PostgreSQL. The vulnerability stems from insecure default administrative credentials that could be created by well-intended Terraform or REST API users before 2025-11-03, enabling a remote attacker to gain full administrative access to the database. ...
CVE-2026-7428
Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password which could have been exploited by a remote attacker to gain full administrative access to the database. Exploitation required...
CVE-2026-4663
REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39608. Reason: This candidate is a reservation duplicate of CVE-2026-39608. Notes: All CVE users should reference CVE-2026-39608 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...
CVE-2026-6708
The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permissioncallback of 'returntrue', which bypasses all...
Malicious code in @mesadev/rest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 388ca6def3456a442ad932d90bb9732118d37d14ad0ac829d1806103e7aff202 The package @mesadev/rest was found to contain malicious code. Source: ghsa-malware b7f0d4cd50a4af49f5499cbe10e56291c9513bc01541e408f04c2662aabb17e0...
MAL-2026-3510 Malicious code in @mesadev/rest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 388ca6def3456a442ad932d90bb9732118d37d14ad0ac829d1806103e7aff202 The package @mesadev/rest was found to contain malicious code. Source: ghsa-malware b7f0d4cd50a4af49f5499cbe10e56291c9513bc01541e408f04c2662aabb17e0...
CVE-2026-6708: Missing Authorization
The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permissioncallback of 'returntrue', which bypasses all...
