@fumapress/ai (>=0.2.3, <=0.2.5), @fumapress/feedback (>=0.2.4, <=0.2.5) +2 more potentially affected by CVE-2026-49455 via waku (>=1.0.0-alpha.5, <=1.0.0-beta.0)

waku NPM version =1.0.0-alpha.5, =0.2.3, =0.2.4, =0.1.0, =0.2.5 - sladocs 0.1.0 Source cves: CVE-2026-49455 Source advisory: SNYK:JS-WAKU-17912686...

@fumapress/ai (>=0.2.3, <=0.2.5), @fumapress/feedback (>=0.2.4, <=0.2.5) +2 more potentially affected by CVE-2026-49455 via waku (>=1.0.0-alpha.5, <=1.0.0-beta.0)

waku NPM version =1.0.0-alpha.5, =0.2.3, =0.2.4, =0.1.0, =0.2.5 - sladocs 0.1.0 Source cves: CVE-2026-49455 Source advisory: OSV:GHSA-75W3-GMQX-993Q...

@fumapress/ai (>=0.2.3, <=0.2.5), @fumapress/feedback (>=0.2.4, <=0.2.5) +2 more potentially affected by CVE-2026-49455 via waku (>=1.0.0-alpha.5, <=1.0.0-beta.0)

waku NPM version =1.0.0-alpha.5, =0.2.3, =0.2.4, =0.1.0, =0.2.5 - sladocs 0.1.0 Source cves: CVE-2026-49455 Source advisory: GHSA-75W3-GMQX-993Q...

cosmicdbsemantic (>=0.0.1, <=0.0.23), drf-account (0.0.1) +3 more potentially affected by CVE-2026-53877 via django (2.0.5)

django PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.1, =0.9.2, =0.9.5 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

cosmicdbsemantic (>=0.0.1, <=0.0.23), drf-account (0.0.1) +3 more potentially affected by CVE-2026-48588 via django (2.0.5)

django PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.1, =0.9.2, =0.9.5 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

cosmicdbsemantic (>=0.0.1, <=0.0.23), drf-account (0.0.1) +3 more potentially affected by CVE-2024-45231 via django (2.0.5)

django PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cosmicdbsemantic =0.0.1, =0.9.2, =0.9.5 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

CVE-2026-41899

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling...

GHSA-24X4-J6X9-RFW5 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Summary An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session...

Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the CraftSupportWidget.js process. An attacker can execute arbitrary JavaScript code in the admin's control panel session by crafting a malicious GitHub issue tit...

CVE-2026-41899 Coolify unauthenticated feedback endpoint allows Discord webhook abuse

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling...

CVE-2026-41899

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling...

CVE-2026-41899 Coolify unauthenticated feedback endpoint allows Discord webhook abuse

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling...

CVE-2026-41899 Coolify unauthenticated feedback endpoint allows Discord webhook abuse

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling...

CVE-2026-41899

CVE-2026-41899 affects Coolify prior to 4.0.0-beta.474. The POST /api/feedback endpoint is unauthenticated, lacks rate limiting and input validation, allowing arbitrary content to reach a Discord webhook and enabling spam, content injection, and webhook abuse. Remediation: upgrade to Coolify 4.0....

CVE-2026-41899: Missing Authentication for Critical Function

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded directly to a Discord webhook and enabling...

PT-2026-56024

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.474 Description The application lacks authentication, rate limiting, and input validation at the 'POST /api/feedback' endpoint. This allows arbitrary content to be forwarded directly to a Discord webhook,...

CVE2PoC

CVE2PoC A prototype for generating real npm vulnerability PoC...

CVE-2026-13567

A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component POST Request Handler. The manipulation of the argument fname/femail/faddress/fmessage results in cross site scripting. The attack may be...

CVE-2026-13567

The CVE-2026-13567 entry affects code-projects Online Music Site 1.0 in the POST Request Handler’s /Frontend/Feedback.php. An attacker can manipulate parameters fname, femail, faddress, or fmessage to trigger cross-site scripting. The issue is remote-present with a publicly released exploit (Proo...

CVE-2026-13567 code-projects Online Music Site POST Request Feedback.php cross site scripting

A security flaw has been discovered in code-projects Online Music Site 1.0. This affects an unknown part of the file /Frontend/Feedback.php of the component POST Request Handler. The manipulation of the argument fname/femail/faddress/fmessage results in cross site scripting. The attack may be...