create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-88060 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-88060 Source advisory: GHSA-V3P8-WHQ6-R5JG...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-88056 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-88056 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-19778590...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-88056 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-88056 Source advisory: OSV:GHSA-F6MR-PJWC-34M4...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-88060 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-88060 Source advisory: MEND:CVE-2026-88060...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-88058 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-88058 Source advisory: MEND:CVE-2026-88058...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the CORE protocol handler. An attacker can manipulate broker state and create arbitrary durable queues by sending unauthenticated requests. Remediation Upgrade...

CVE-2025-24979

Server-side request forgery SSRF vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces localhost, or cloud metadata...

SUSE CVE-2026-80821

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on createcq mapping failure nvmetpciepfcreatecq calls nvmetcqcreate, which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or...

CVE-2026-12230: Improper Neutralization of Input During Web Page Generation

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layoutcustomcss' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-89742

Name of the Vulnerable Software and Affected Versions strongSwan versions 5.9.7 through 6.0.7 Description The libcharon component mishandles the behavioral workflow within the IKEv2 state machine. This improper handling of CREATE CHILD SA requests can lead to an authentication bypass...

CVE-2026-85701

A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/init.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be...

CVE-2026-80821 nvmet: pci-epf: put CQ ref on create_cq mapping failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on createcq mapping failure nvmetpciepfcreatecq calls nvmetcqcreate, which takes a reference on the controller and installs the completion queue. If the subsequent PCI address-space mapping fails or...

Incorrect Authorization

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Incorrect Authorization in the question/create endpoint due to the isAddingQuestionsAllowed method granting access to all callers when...

Incorrect Authorization

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Incorrect Authorization in the question/create endpoint due to the isAddingQuestionsAllowed method granting access to all callers when...

CVE-2026-85592 phpMyFAQ before 4.1.8 Authorization Bypass via question/create

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...

CVE-2026-85592 phpMyFAQ before 4.1.8 Authorization Bypass via question/create

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...

CVE-2026-85592

phpMyFAQ versions before 4.1.8 are affected by an authorization bypass in the question/create API endpoint. The underlying cause is that the isAddingQuestionsAllowed() method grants access to all callers when main.enableAskQuestions is enabled, while ignoring the records.allowQuestionsForGuests s...

create-graphene (>=0.0.24, <=0.0.30) potentially affected by CVE-2026-85525 via snowflake-sdk (3.1.0)

snowflake-sdk NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-sdk and may be impacted: - create-graphene =0.0.24, =0.0.30 Source cves: CVE-2026-85525 Source advisory: SNYK:JS-SNOWFLAKESDK-19638986...

Malicious Package

Overview create-mono-package is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-85664: Allocation of Resources Without Limits or Throttling

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters maxneighbors, efconstruction, and efsearch in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction...