CVE-2026-30691

Cross-Site Scripting XSS vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode...

CVE-2026-30691

Cross-Site Scripting XSS vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode...

react-doc-viewer 跨站脚本漏洞

react-doc-viewer is a React documentation viewer component developed by Damian Cyntler. Version 1.17.1 of react-doc-viewer contains a cross-site scripting vulnerability. This vulnerability arises from the TXTRenderer component failing to clean up file content and explicitly converting raw data in...

Insertion of Sensitive Information Into Sent Data

Overview dbt-mcp is an A MCP Model Context Protocol server for interacting with dbt resources. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the emittoolcalledevent process, which serializes and transmits all tool arguments, including...

Insertion of Sensitive Information into Log File

Overview dbt-mcp is an A MCP Model Context Protocol server for interacting with dbt resources. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the calltool process when file logging is enabled via the DBTMCPSERVERFILELOGGING setting. An...

Arbitrary Argument Injection

Overview dbt-mcp is an A MCP Model Context Protocol server for interacting with dbt resources. Affected versions of this package are vulnerable to Arbitrary Argument Injection via the nodeselection or resourcetype parameters in the rundbtcommand process. An attacker can override configuration fil...

CVE-2026-3143 Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxclicancel' function in all versions up to, and including, 1.17.1. This makes it possible for...

CVE-2026-3143 Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxclicancel' function in all versions up to, and including, 1.17.1. This makes it possible for...

CVE-2026-3143

The CVE concerns the BoldGrid WordPress plugin component of Total Upkeep – WordPress Backup Plugin plus Restore & Migrate. A missing capability check in wp_ajax_cli_cancel allows unauthenticated users to cancel a pending rollback, enabling unauthorized data modification in all versions up to 1.17...

PT-2026-36323

Name of the Vulnerable Software and Affected Versions Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid versions prior to 1.17.2 Description The plugin is susceptible to unauthorized data modification because the wp ajax cli cancel function lacks a proper capability check...

WordPress Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation vulnerability

Missing Authorization to Unauthenticated Rollback Cancellation vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Total Upkeep versions = 1.17.1...

OPENSUSE-SU-2026:10570-1 aardvark-dns-1.17.1-1.1 on GA media

These are all security issues fixed in the aardvark-dns-1.17.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-35406

Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1...

CVE-2026-35406

Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1...

CVE-2026-35406 Aardvark-dns has incorrect error handling for malformed tcp packets

Aardvark-dns is an authoritative dns server for A/AAAA container records. From 1.16.0 to 1.17.0, a truncated TCP DNS query followed by a connection reset causes aardvark-dns to enter an unrecoverable infinite error loop at 100% CPU. This vulnerability is fixed in 1.17.1...

CVE-2026-35406

Affected software: aardvark-dns (authoritative DNS server for A/AAAA container records). Vulnerable versions: 1.16.0 through 1.17.0. Root cause: a truncated TCP DNS query followed by a connection reset can cause the process to enter an unrecoverable infinite error loop, consuming 100% CPU. Impact...

CLEANSTART-2026-UK15999 Security fixes for CVE-2025-15558, CVE-2025-47907, CVE-2026-24051, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-2x5j-vhc8-9cwm, ghsa-6m8w-jc87-6cr7, ghsa-p436-gjf2-799p, ghsa-p77j-4mvh-x3m3, ghsa-vvgc-356p-c3xw applied in versions: 1.14.4-r1, 1.14.4-r2, 1.17.1-r2, 1.17.1-r3

Multiple security vulnerabilities affect the kyverno-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

Server-side Request Forgery (SSRF)

Overview @opennextjs/cloudflare is a Cloudflare builder for next apps Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the cdn-cgi/image/ handler due to improper path normalization. An attacker can cause the server to fetch arbitrary remote URLs and...

OPENSUSE-SU-2026:10233-1 kyverno-1.17.1-1.1 on GA media

These are all security issues fixed in the kyverno-1.17.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-2622

A vulnerability was detected in Blossom up to 1.17.1. This vulnerability affects the function content of the file blossom-backend/backend/src/main/java/com/blossom/backend/server/article/draft/ArticleController.java of the component Article Title Handler. The manipulation results in cross site...