CVE-2026-15450

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

CVE-2026-9044

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...

Malicious code in sap-mcp-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd73a0cce0624f18914a46c4fd174111ed722c842cd0d664a16299ac145385ce The package name suggests an SAP MCP configuration helper ships lib/report.js which, from a postinstall hook, collects developer identity data — emai...

MAL-2026-11481 Malicious code in sap-mcp-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd73a0cce0624f18914a46c4fd174111ed722c842cd0d664a16299ac145385ce The package name suggests an SAP MCP configuration helper ships lib/report.js which, from a postinstall hook, collects developer identity data — emai...

CVE-2026-41852 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, keycloak-config-cli, zipkin...

GHSA-R5W3-XV2F-J59Q vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, keycloak-config-cli, zipkin...

CVE-2026-41848 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, keycloak-config-cli, zipkin...

CVE-2026-41850 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, keycloak-config-cli, zipkin...

GHSA-9F52-RJQV-25QV vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, keycloak-config-cli, zipkin...

CVE-2026-41851 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, keycloak-config-cli, zipkin...

GHSA-WXPP-56Q6-5PCG vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, keycloak-config-cli, zipkin...

CVE-2026-41851 vulnerabilities

Vulnerabilities for packages: kafbat-ui, camunda, jenkins, kafbat-ui-fips, apache-camel-karavan-devmode, keycloak-config-cli, camunda-zeebe, apache-nifi-registry, apache-activemq, zipkin, apache-activemq-fips...

CVE-2026-41852 vulnerabilities

Vulnerabilities for packages: kafbat-ui, camunda, jenkins, kafbat-ui-fips, apache-camel-karavan-devmode, keycloak-config-cli, camunda-zeebe, apache-nifi-registry, apache-activemq, zipkin, apache-activemq-fips...

GHSA-9F52-RJQV-25QV vulnerabilities

Vulnerabilities for packages: kafbat-ui, camunda, jenkins, kafbat-ui-fips, apache-camel-karavan-devmode, keycloak-config-cli, camunda-zeebe, apache-nifi-registry, apache-activemq, zipkin, apache-activemq-fips...

CVE-2026-41848 vulnerabilities

Vulnerabilities for packages: kafbat-ui, camunda, jenkins, kafbat-ui-fips, apache-camel-karavan-devmode, keycloak-config-cli, camunda-zeebe, apache-nifi-registry, apache-activemq, zipkin, apache-activemq-fips...

CVE-2026-41850 vulnerabilities

Vulnerabilities for packages: kafbat-ui, camunda, jenkins, kafbat-ui-fips, apache-camel-karavan-devmode, keycloak-config-cli, camunda-zeebe, apache-nifi-registry, apache-activemq, zipkin, apache-activemq-fips...

GHSA-R5W3-XV2F-J59Q vulnerabilities

Vulnerabilities for packages: kafbat-ui, camunda, jenkins, kafbat-ui-fips, apache-camel-karavan-devmode, keycloak-config-cli, camunda-zeebe, apache-nifi-registry, apache-activemq, zipkin, apache-activemq-fips...

GHSA-WXPP-56Q6-5PCG vulnerabilities

Vulnerabilities for packages: kafbat-ui, camunda, jenkins, kafbat-ui-fips, apache-camel-karavan-devmode, keycloak-config-cli, camunda-zeebe, apache-nifi-registry, apache-activemq, zipkin, apache-activemq-fips...

NPM: Jodit has prototype pollution via Jodit.configure() / ConfigMerge

NPM: Jodit has prototype pollution via Jodit.configure / ConfigMerge vulnerability discovered by ? in WordPress Npm jodit versions 4.12.18...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...