CVE-2026-33378 Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro

Using the $timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server...

CVE-2026-33378

Using the $timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server...

CVE-2025-32425

CVE-2025-32425 affects AutoGPT platform prior to v0.6.32, where container execution logs emitted to stdout/stderr could be captured by Docker and stored as container logs without a size limit. This lack of log rotation/log size control can lead to server disk resource exhaustion and DoS under hig...

CVE-2025-32425

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, the execution process is recorded to the console stdout/stderr, and deployed in container mode, which is automatically captured by Docker an...

CVE-2026-44288 vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

CVE-2026-44292 vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

CVE-2026-44294 vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

GHSA-66FF-XGX4-VCHM vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

GHSA-685M-2W69-288Q vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

GHSA-FX83-V9X8-X52W vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

CVE-2026-44289 vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

CVE-2026-44290 vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

GHSA-2PR8-PHX7-X9H3 vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

GHSA-Q6X5-8V7M-XCRF vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

GHSA-JVWF-75H9-CWGG vulnerabilities

Vulnerabilities for packages: gemini-cli, vitess, kubeflow-centraldashboard, pulumi, librechat, renovate, kibana, opentelemetry-auto-instrumentations-node, nemo, cadence-web, homepage...

CVE-2026-7051: Missing Authorization

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 8.9.0. This is due to a missing ownership verification in the B2SPostTools::deleteUserPublishPost and B2SPostTools::deleteUserSchedPost functions,...

Quark-auto-save security vulnerability

Quark-auto-save is a personal development tool created by Cp0204, designed for automatic transfer of data to Quark Cloud Storage and management of sign-ins. Versions of quark-auto-save prior to 0.8.5 contained security vulnerabilities. These vulnerabilities stemmed from a batch assignment...

PT-2026-40792

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An Out-of-Memory OOM condition can be triggered by overloading the server through the use of the $ timeGroup macro. This issue requires the use of a SQL...

CVE-2026-44166

PocketBase suffers an account pre-hijacking vulnerability via OAuth2 unverfied→verified autolinking. An attacker who knows a victim’s email can pre-create and link an unverified PocketBase user by authenticating with an OAuth2 provider (e.g., A). When the victim later signs up with a different pr...

CVE-2026-44166 Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade

Pocketbase is an open source web backend written in go. Prior to 0.22.42 and 0.37.4, in some situations, if an attacker knows the email address of the victim they can create and link an unverified PocketBase user in advance by authenticating with one of the OAuth2 app providers, e.g. "A". When th...