RealVuln: Benchmarking Rule-Based, General-Purpose LLM, and Security-Specialized Scanners on Real-World Code

How do security scanners perform on real-world code? We present RealVuln, the first open-source benchmark comparing Rule-Based SAST, General-Purpose LLMs, and Security-Specialized scanners on 26 intentionally vulnerable Python repositories educational and Capture-The-Flag applications with 796...

@semic/testing (=2.2.11), @vendure/dashboard (>=3.2.2 <=3.4.4) potentially affected by CVE-2026-40887 via @vendure/core (>=3.0.0 <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-40887 Source advisory: SNYK:JS-VENDURECORE-16068909...

@semic/testing (=2.2.11), @vendure/dashboard (>=3.2.2 <=3.4.4) potentially affected by CVE-2026-40887 via @vendure/core (>=3.0.0 <=3.4.4)

@vendure/core NPM version =3.0.0, =3.2.2, =3.4.4 Source cves: CVE-2026-40887 Source advisory: OSV:GHSA-9PP3-53P2-WW9V...

CVE-2026-40089

Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery SSRF vulnerability in its API client apps/dashboard/lib/api.ts. Installations created using the provided install.sh script includi...

CVE-2026-26460

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view getTabContents action, allowing an attacker to inject arbitrary HTML content into the dashboard...

GHSA-CHQC-8P9Q-PQ6Q vulnerabilities

Vulnerabilities for packages: code-server, opensearch-dashboards-fips, kibana, opensearch-dashboards, langfuse, wazuh-dashboard, langfuse-fips...

CVE-2026-39983 vulnerabilities

Vulnerabilities for packages: code-server, opensearch-dashboards-fips, kibana, opensearch-dashboards, langfuse, wazuh-dashboard, langfuse-fips...

GHSA-6V7Q-WJVX-W8WG vulnerabilities

Vulnerabilities for packages: code-server, opensearch-dashboards-fips, kibana, opensearch-dashboards, langfuse, wazuh-dashboard, langfuse-fips...

GHSA-FVCV-3M26-PCQX vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kubeflow-centraldashboard, librechat, nextcloud-server, kibana, opensearch-dashboards, gitlab-rails-ce-fips, langfuse, opensearch-dashboards-fips, kubeflow-katib, prism, saf, redisinsight, wazuh-dashboard, jitsucom-jitsu, langfuse-fips, lerna, awx...

CVE-2026-40175 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kubeflow-centraldashboard, librechat, nextcloud-server, kibana, opensearch-dashboards, gitlab-rails-ce-fips, langfuse, opensearch-dashboards-fips, kubeflow-katib, prism, saf, redisinsight, wazuh-dashboard, jitsucom-jitsu, langfuse-fips, lerna, awx...

EUVD-2026-22096

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view getTabContents action, allowing an attacker to inject arbitrary HTML content into the dashboard...

CVE-2026-26460

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view getTabContents action, allowing an attacker to inject arbitrary HTML content into the dashboard...

PT-2026-32521

Name of the Vulnerable Software and Affected Versions Vtiger CRM version 8.4.0 Description An HTML Injection issue exists in the Dashboard module. The application fails to properly neutralize user-supplied input in the tabid parameter of the 'DashBoardTab' view 'getTabContents' action, allowing a...

CVE-2026-26460

CVE-2026-26460 describes an HTML Injection vulnerability in the Dashboard module of Vtiger CRM 8.4.0 . The issue arises because user input in the tabid parameter of the DashBoardTab view (getTabContents action) is not properly neutralized, allowing an attacker to inject arbitrary HTML that gets r...

CVE-2026-26460

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view getTabContents action, allowing an attacker to inject arbitrary HTML content into the dashboard...

CVE-2026-26460

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view getTabContents action, allowing an attacker to inject arbitrary HTML content into the dashboard...

CVE-2026-26460

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view getTabContents action, allowing an attacker to inject arbitrary HTML content into the dashboard...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: libnvidia-container, prometheus, aws-flb-firehose, karpenter, hubble, ingress-nginx-controller, kube-fluentd-operator, cilium-cli, external-secrets-operator, chezmoi, telegraf, dask-gateway, falco-no-driver, spire-server, kube-arangodb, aws-flb-kinesis, zot, redka,...

GHSA-XJ38-JXC5-RPPX vulnerabilities

Vulnerabilities for packages: libnvidia-container, prometheus, aws-flb-firehose, karpenter, hubble, ingress-nginx-controller, kube-fluentd-operator, cilium-cli, external-secrets-operator, chezmoi, telegraf, dask-gateway, falco-no-driver, spire-server, kube-arangodb, aws-flb-kinesis, zot, redka,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: rancher-helm, libnvidia-container, flux-image-automation-controller, apisix-ingress-controller, aws-flb-firehose, grafana-rollout-operator, hubble, rancher-agent, cilium-cli, contour, external-secrets-operator, timoni, helm-set-status, nuclei, syft, cerbos, keda, wav...