@cubejs-backend/server (>=1.5.0, <=1.5.12), @cubejs-backend/testing-drivers (>=1.5.0, <=1.5.12) potentially affected by CVE-2026-25958 via @cubejs-backend/server-core (>=1.5.0, <=1.5.12)

@cubejs-backend/server-core NPM version =1.5.0, =1.5.0, =1.5.0, =1.5.12 Source cves: CVE-2026-25958 Source advisory: OSV:GHSA-V226-32C7-X2V7...

@cubejs-backend/server (>=1.1.0, <=1.4.1), @cubejs-backend/testing-drivers (>=1.1.0, <=1.4.1) potentially affected by CVE-2026-25958 via @cubejs-backend/server-core (>=1.1.0, <=1.4.1)

@cubejs-backend/server-core NPM version =1.1.0, =1.1.0, =1.1.0, =1.4.1 Source cves: CVE-2026-25958 Source advisory: OSV:GHSA-V226-32C7-X2V7...

PT-2026-7327

Name of the Vulnerable Software and Affected Versions Worklenz versions prior to 2.1.7 Description Worklenz, a project management tool, contains multiple SQL injection flaws in its backend SQL query construction. These flaws affect project and task management controllers, reporting and financial...

Siemens SCALANCE and RUGGEDCOM Buffer Over-read (CVE-2024-6874)

libcurl's URL API function curlurlget offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the macidn IDN backend. The conversion function then fills up the provided buffer exact...

@codefresh-io/cubejs-backend-server-core (>=0.30.77, <=0.35.49), @cubejs-backend-json-clone/server (1.0.0) +14 more potentially affected by CVE-2026-25958 via @cubejs-backend/api-gateway (>=0.27.53, <=1.0.12)

@cubejs-backend/api-gateway NPM version =0.27.53, =0.30.77, =0.27.0, =0.27.0, =0.27.0, =0.27.0, =0.27.0, =0.32.28, =0.29.4, =1.0.0, =0.27.30, =0.30.61, =0.32.0, =0.33.8 and more Source cves: CVE-2026-25958 Source advisory: SNYK:JS-CUBEJSBACKENDAPIGATEWAY-15265447...

@cubejs-backend/server (>=1.1.0, <=1.4.0), @cubejs-backend/server-core (>=1.1.0, <=1.4.0) +2 more potentially affected by CVE-2026-25958 via @cubejs-backend/api-gateway (>=1.1.0, <=1.4.0)

@cubejs-backend/api-gateway NPM version =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.4.0 - cubejs-backend-server-core-fork 1.1.3 Source cves: CVE-2026-25958 Source advisory: SNYK:JS-CUBEJSBACKENDAPIGATEWAY-15265447...

@cubejs-backend/server (>=1.5.0, <=1.5.12), @cubejs-backend/server-core (>=1.5.0, <=1.5.12) +1 more potentially affected by CVE-2026-25958 via @cubejs-backend/api-gateway (>=1.5.0, <=1.5.12)

@cubejs-backend/api-gateway NPM version =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.12 Source cves: CVE-2026-25958 Source advisory: SNYK:JS-CUBEJSBACKENDAPIGATEWAY-15265447...

@cubejs-backend/server (>=1.1.17, <=1.4.0), @cubejs-backend/server-core (>=1.1.17, <=1.4.0) +1 more potentially affected by CVE-2026-25957 via @cubejs-backend/api-gateway (>=1.1.17, <=1.4.0)

@cubejs-backend/api-gateway NPM version =1.1.17, =1.1.17, =1.1.17, =1.1.17, =1.4.0 Source cves: CVE-2026-25957 Source advisory: SNYK:JS-CUBEJSBACKENDAPIGATEWAY-15265448...

CVE-2026-25806

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do...

CVE-2026-25810 PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization ownership checks...

CVE-2026-25810

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization ownership checks...

CVE-2026-25810 PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization ownership checks...

CVE-2026-25876 PlaciPy is Missing Authorization on Assessment Results Endpoint

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization ownership checks. For example, this can be used to return all results for an assessment...

PT-2026-7154

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the GET /api/students/:email PUT /api/students/:email/status, and DELETE /api/students/:email routes in backend/src/routes/student.routes.ts only enforce authentication using authenticateToken but do...

CVE-2026-2164

A security flaw has been discovered in detronetdip E-commerce 1.0.0. This issue affects some unknown processing of the file /seller/assets/backend/profile/addadhar.php. Performing a manipulation of the argument File results in unrestricted upload. Remote exploitation of the attack is possible. Th...

CVE-2026-2164 detronetdip E-commerce addadhar.php unrestricted upload

A security flaw has been discovered in detronetdip E-commerce 1.0.0. This issue affects some unknown processing of the file /seller/assets/backend/profile/addadhar.php. Performing a manipulation of the argument File results in unrestricted upload. Remote exploitation of the attack is possible. Th...

[SECURITY] Fedora 43 Update: xorgxrdp-0.10.5-1.fc43

xorgxrdp is a set of X11 modules that make Xorg act as a backend for xrdp. Xorg with xorgxrdp is the most advanced xrdp backend with support for screen resizing and multiple monitors...

[SECURITY] Fedora 42 Update: xorgxrdp-0.10.5-1.fc42

xorgxrdp is a set of X11 modules that make Xorg act as a backend for xrdp. Xorg with xorgxrdp is the most advanced xrdp backend with support for screen resizing and multiple monitors...

E-commerce 代码问题漏洞

E-commerce is a dynamic e-commerce website developed by Bhabishya Ghimire as an individual developer. Version 1.0.0 of E-commerce has code-related vulnerabilities; these vulnerabilities stem from incorrect handling of parameters in the file /seller/assets/backend/profile/addadhar.php, which may...

CVE-2026-22254

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would...