com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (=24.3.0.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (=24.3.0.0) +65 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-saml-core (>=1.9.0.CR1 <=26.5.3)

org.keycloak:keycloak-saml-core MAVEN version =1.9.0.CR1, =2.5.6-24.0, =1.0.0-25.0, =0.1.0, =2.1, =8.1, =2.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.5.3 and more Source cves: CVE-2026-2575https://vulners.com/cve/CVE-20...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.charlyghislain.keycloak:keycloak-importexport (>=21.0.0 <=23.0.1) +145 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-services (>=1.9.0.CR1 <=26.5.3)

org.keycloak:keycloak-services MAVEN version =1.9.0.CR1, =0.1.0, =21.0.0, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.0.0, =1.2.0 and more Source cves: CVE-2026-2575 Source advisory: SNYK:JAVA-ORGKEYCLOAK-15304465https://vulners.com/snyk/SNYK:JAVA-ORG...

PT-2026-8315

Name of the Vulnerable Software and Affected Versions Flos Freeware Notepad2 versions 4.2.22 through 4.2.25 Description A security flaw exists in Flos Freeware Notepad2. The issue involves an uncontrolled search path within an unknown function in the Msimg32.dll library. Local access is required...

VulnCheck KEV: CVE-2023-27032

Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups...

CVE-2025-69633

A SQL Injection vulnerability in the Advanced Popup Creator advancedpopupcreator module for PrestaShop 1.1.26 through 1.2.6 Fixed in version 1.2.7 allows remote unauthenticated attackers to execute arbitrary SQL queries via the fromController parameter in the popup controller. The parameter is...

n8n Node.js Package >= 0.187.0 < 1.120.3 Command Injection (CVE-2026-21893)

The version of the n8n Node.js Package installed on the remote host is = 0.187.0 and prior to 1.120.3. It is, therefore, affected by a command injection vulnerability: - A command injection vulnerability was identified in n8n's community package installation functionality. The issue allows...

UBUNTU-CVE-2026-2327

Versions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service ReDoS due to the use of the regex /+$/ in the linkify function. An attacker can supply a long sequence of characters followed by a non-matching character, which triggers...

Dell Update Package Framework 安全漏洞

Dell Update Package Framework is a framework developed by the American company Dell for updating system components. This product primarily provides installation programs for drivers, applications, BIOS, and firmware. Versions of the Dell Update Package Framework from 23.12.00 to 24.12.00 containe...

Scraparr 信息泄露漏洞

Scraparr is a Prometheus exporter for arr suites Sonarr, Radarr, Lidarr, etc. developed by TheCfU organization. Versions of Scraparr from 3.0.0-beta to 3.0.2 contained an information leakage vulnerability. This vulnerability occurred when the Readarr integration was enabled, as the exporter expos...

GitLab 13.2 < 18.4.5 / 18.5 < 18.5.3 / 18.6 < 18.6.1 (CVE-2025-13611)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with access to...

a-simple-llm-kit (>=0.3.0 <=0.4.2), a62-emotion (>=0.9.2 <=0.11.4) +3568 more potentially affected by CVE-2025-69872 via diskcache (>=2.4.1 <=5.6.3)

diskcache PYPI version =2.4.1, =0.3.0, =0.9.2, =0.1.0, =0.2.1, =0.1.1.dev1, =0.1.0, =0.3.4, =0.1.1, =0.3.3, =0.0.2, =1.13.4 - acai-swarm =0.1.0 - accern-xyme =0.2.5 and more Source cves: CVE-2025-69872 Source advisory: OSV:GHSA-W8V5-VHQR-4H9V...

CVE-2026-25990

Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1...

CVE-2026-26003

FastGPT is an AI Agent building platform. From 4.14.0 to 4.14.5, attackers can directly access the plugin system through FastGPT/api/plugin/xxx without authentication, thereby threatening the plugin system. This may cause the plugin system to crash and the loss of plugin installation status, but ...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8 <=3.1.14-jdk17) +192 more potentially affected by CVE-2026-2366 via org.keycloak:keycloak-services (>=10.0.0 <=26.5.5)

org.keycloak:keycloak-services MAVEN version =10.0.0, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.4.11 - com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak =24.3.0.0 -...

Turboard 跨站脚本漏洞

Turboard is a business intelligence data visualization and analysis platform developed by Turboard Inc. In versions 2025.07 to 11022026 of Turboard, there is a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, which may lead to...

PT-2026-7591

Name of the Vulnerable Software and Affected Versions Logo j-Platform versions 3.29.6.4 through 13112025 Description An issue exists in Logo j-Platform that allows for the insertion of sensitive information into externally-accessible files or directories due to incorrectly configured access contr...

PT-2026-7525

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.4 through 18.6.5 GitLab CE/EE versions 18.7 through 18.7.3 GitLab CE/EE versions 18.8 through 18.8.3 Description An unauthenticated user could potentially cause a denial of service by exhausting memory or CPU resources...

Logo j-Platform 安全漏洞

Logo j-Platform is an enterprise resource planning platform developed by the Turkish company Logo. Versions of Logo j-Platform from 3.29.6.4 to 13112025 contain security vulnerabilities. These vulnerabilities stem from the insertion of sensitive information into externally accessible files or...

GHSA-X9VF-53Q3-CVX6 CASL Ability is Vulnerable to Prototype Pollution

CASL Ability, versions 2.4.0 through 6.7.4, contains a prototype pollution vulnerability...

CVE-2026-26003

FastGPT is an AI Agent building platform. From 4.14.0 to 4.14.5, attackers can directly access the plugin system through FastGPT/api/plugin/xxx without authentication, thereby threatening the plugin system. This may cause the plugin system to crash and the loss of plugin installation status, but ...