CVE-2026-25921

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2...

CVE-2026-25921 Gogs: Cross-repository LFS object overwrite via missing content hash verification

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2...

web3.db-fileconnector (>=1.4.0, <=1.8.6) potentially affected by CVE-2025-64166 via mercurius (16.1.0)

mercurius NPM version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on mercurius and may be impacted: - web3.db-fileconnector =1.4.0, =1.8.6 Source cves: CVE-2025-64166 Source advisory: OSV:GHSA-V66J-6WWF-JC57...

EUVD-2026-9818

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'downloadcsv' function. This makes it possible for unauthenticated attackers to inject a P...

CVE-2026-2599

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'downloadcsv' function. This makes it possible for unauthenticated attackers to inject a P...

CVE-2026-2599

CVE-2026-2599 : The WordPress plugin cluster “Database for Contact Form 7, WPforms, Elementor forms” is affected by an unauthenticated PHP Object Injection via deserialization in the download_csv function (vulnerable through 1.4.7). The vulnerability alone has no impact unless a PHP Object Payloa...

CVE-2026-2599

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'downloadcsv' function. This makes it possible for unauthenticated attackers to inject a P...

CVE-2026-2599 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv'

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'downloadcsv' function. This makes it possible for unauthenticated attackers to inject a P...

SUSE CVE-2026-23231

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix use-after-free in nftablesaddchain nftablesaddchain publishes the chain to table-chains via listaddtailrcu in nftchainadd before registering hooks. If nftablesregisterhook then fails, the error path calls...

@backstage/backend-defaults (0.15.3-next.0), @backstage/backend-dynamic-feature-service (0.7.10-next.0) +69 more potentially affected by CVE-2026-29185 via @backstage/integration (1.21.0-next.0)

@backstage/integration NPM version 1.21.0-next.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/integration and may be impacted: - @backstage/backend-defaults 0.15.3-next.0 - @backstage/backend-dynamic-feature-service 0.7.10-next.0 -...

PT-2026-23506

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10 Description A time-of-check-time-of-use TOCTOU issue exists in the validateScriptFileForShellBleed function. A TOCTOU issue is a software bug where a system checks a condition such as a security credential...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: resource-agents (UTSA-2026-005593)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005593 advisory. urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded...

Cyber Threat Intelligence for Artificial Intelligence Systems

As artificial intelligence AI becomes deeply embedded in critical services and everyday products, it is increasingly exposed to security threats which traditional cyber defenses were not designed to handle. In this paper, we investigate how cyber threat intelligence CTI may evolve to address...

Gogs（Go Git Service） 数据伪造问题漏洞

Gogs Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Prior to version 0.14.2 of Gogs Go Git Service, there was a data manipulation...

@343dev/optimizt (>=12.0.0, <=12.1.1), @cjy0812/inspect-plus (>=0.0.1772240426360, <=0.0.1774152861718) +38 more potentially affected by CVE-2026-29074 via svgo (4.0.0-rc.0)

svgo NPM version 4.0.0-rc.0 is affected by a known vulnerability. The following packages have a transitive dependency on svgo and may be impacted: - @343dev/optimizt =12.0.0, =0.0.1772240426360, =6.13.0, =0.0.1769658265953, =1.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.47.0, =0.1.202510281000, =0.1....

@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.12.0) +131 more potentially affected by CVE-2026-29063 via immutable (>=5.0.0, <=5.1.4)

immutable NPM version =5.0.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =0.1.0, =1.0.6 - @dreamcatcher-tech/web 0.0.0 and more Source cves: CVE-2026-29063 Source advisory: OSV:GHSA-WF6X-7X77-MVGW...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @agimon-ai/browse-tool (>=0.2.0, <=0.5.5) +207 more potentially affected by CVE-2026-29087 via @hono/node-server (>=1.0.2, <=1.19.9)

@hono/node-server NPM version =1.0.2, =0.1.8-fix.3, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =1.0.25-beta.0, =0.0.1, =0.0.1-experimental.1, =0.1.0, =0.3.4 - @babybase/ui 0.2.0 and more Source cves: CVE-2026-29087 Source advisory: OSV:GHSA-WC8C-QW6V-H7F6...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +381 more potentially affected by CVE-2026-29086 via hono (>=4.0.0, <=4.12.3)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =0.0.1, =0.0.1, =0.0.1-experimental.1, =0.0.19 and more Source cves: CVE-2026-29086 Source advisory: OSV:GHSA-5PQ2-9X2X-5P6W...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +668 more potentially affected by CVE-2026-28343 via @ckeditor/ckeditor5-html-support (>=29.2.0, <=47.5.0-alpha.8)

@ckeditor/ckeditor5-html-support NPM version =29.2.0, =0.0.1, =0.0.3, =0.0.1, =3.0.8, =0.0.1, =42.0.1, =2.0.0, =0.7.0, =0.0.6, =1.0.1, =0.0.1, =0.0.1, =1.0.0, =36.0.0, =0.0.2, =0.0.31 and more Source cves: CVE-2026-28343 Source advisory: OSV:GHSA-JRQM-VMQC-GM93...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1510 more potentially affected by CVE-2026-3520 via multer (>=2.0.0, <=2.1.0)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-3520 Source advisory: SNYK:JS-MULTER-15417528...