CVE-2026-75980: Improper Neutralization of Input During Web Page Generation

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

K000163050: Spring REST Docs vulnerability CVE-2026-40991

Security Advisory Description When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, trivy, pluto, helm-push, rancher-helm, zarf, cilium-cli, flux, chart-testing, cert-manager-cmctl, k9s, flux-helm-controller, cluster-api-helm-controller, kubescape, flux-source-controller, eksctl, zot, chartmuseum, tw, helm-docs, kots, helm-operator...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: dex, trivy, k3s, dagger, temporal, melange, tflint, ferretdb, k3d, ksops, dbmate, pulumi-language-dotnet, kubernetes-csi-external-provisioner, conftest, restic, cloudnative-pg, spicedb, grafana-mimir, spire-server, zarf, cilium-cli, sops, certificate-transparency,...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, trivy, rancher-fleet, pluto, helm-push, rancher-helm, zarf, cilium-cli, chart-testing, kargo, linkerd2, cert-manager-cmctl, k8sgpt, k9s, envoy-gateway, flux-helm-controller, cluster-api-helm-controller, flux-source-controller, eksctl, zot, cerbos,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: k3s, http-echo, newrelic-infra-operator, clickhouse-operator, sftpgo-plugin-auth, azure-service-operator, cfssl, kubernetes-csi-driver-nfs, octo-sts, timoni, tofu-controller, verticadb-operator, mattermost, azcopy, ratify, ferretdb, x509-certificate-exporter, src,...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.9.8 release.

Red Hat Developer Hub 1.9.8 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

CVE-2026-19323

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

CVE-2026-19323 azer react-analyzer-mcp analyze-projec index.ts generateProjectDocs path traversal

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

CVE-2026-19323

CVE-2026-19323 affects the generateProjectDocs function in src/index.ts of the analyze-projec component of the azer react-analyzer-mcp. The vulnerability arises from manipulation of the projectName argument, which can lead to path traversal. Exploitation is described as requiring local access. Th...

CVE-2026-19323

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

MAL-2026-11805 Malicious code in @qlik/sprout-design-docs (npm)

npm/@qlik/sprout-design-docs is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11853 Malicious code in @servicetitan/docs-anvil-uikit-contrib (npm)

npm/@servicetitan/docs-anvil-uikit-contrib is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...

Malicious code in @servicetitan/uikit-docs (npm)

npm/@servicetitan/uikit-docs is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11854 Malicious code in @servicetitan/docs-uikit (npm)

npm/@servicetitan/docs-uikit is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11952 Malicious code in @thiennq/docs-viewer (npm)

npm/@thiennq/docs-viewer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

Malicious code in @thiennq/docs-viewer (npm)

npm/@thiennq/docs-viewer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

CVE-2026-69085

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 release.

Red Hat Developer Hub 1.10.3 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

[SECURITY] Fedora 44 Update: python3.12-3.12.13-6.fc44

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...