CVE-2026-48157

Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle and/or setDescription to include untrusted/request-derived data in the error title or description e.g. "No products found...

EUVD-2026-36462

Netty: QUIC stateless reset token material exposed through header-visible connection IDs...

Operation on a Resource after Expiration or Release

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release in the CurlAsyncHTTPClient, where per-request credentials such as client TLS...

CVE-2026-39468

WordPress Meta Box – WordPress Custom Fields Framework plugin

CVE-2026-39468 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability

Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework = 5.11.1 versions...

CVE-2026-39468 WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion vulnerability

Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework = 5.11.1 versions...

com.drivetribe:orchestra-core_sjs0.6_2.12 (>=0.1, <=0.7), com.drivetribe:orchestra-cron_sjs0.6_2.12 (>=0.1, <=0.7) +123 more potentially affected by CVE-2026-48125 via org.webjars.npm:ua-parser-js (>=0.7.41, <=2.0.0-alpha.3)

org.webjars.npm:ua-parser-js MAVEN version =0.7.41, =0.1, =0.1, =0.1, =0.8, =0.8, =0.8, =7.1.0-rc6, =7.1.0-rc3, =7.1.0-rc3, =7.1.0-rc3, =1.0.0-rc2, =1.0.0-rc2, =1.0.5 and more Source cves: CVE-2026-48125 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17353323...

@remix-run/architect (>=2.17.3, <=2.17.4), @remix-run/cloudflare (>=2.17.3, <=2.17.4) +10 more potentially affected by CVE-2026-53663 via @remix-run/server-runtime (>=2.17.3, <=2.17.4)

@remix-run/server-runtime NPM version =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =2.17.3, =0.11.30, =0.12.30 Source cves: CVE-2026-53663 Source advisory: OSV:GHSA-84G9-W2XQ-VCV6...

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight, SameSite cookies already block the cross-origin attack vectors...

@a1st/aix (>=0.0.3, <=0.8.0), @a1st/aix-core (>=0.2.0, <=0.8.0) +122 more potentially affected by CVE-2026-53633 via vitest (>=4.0.0-beta.7, <=4.1.7)

vitest NPM version =4.0.0-beta.7, =0.0.3, =0.2.0, =0.0.21, =0.79.1, =2.1.0-alpha.278, =2.1.0-alpha.281 and more Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITEST-17375131...

@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

A Denial of Service DoS vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted,...

GHSA-P3VC-36G9-X9GR @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

A Denial of Service DoS vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) potentially affected by CVE-2026-50169 via @angular/service-worker (>=20.0.0, <=20.3.17)

@angular/service-worker NPM version =20.0.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 Source cves: CVE-2026-50169 Source advisory: SNYK:JS-ANGULARSERVICEWORKER-17359086...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) potentially affected by CVE-2026-50169 via @angular/service-worker (>=20.0.0, <=20.3.17)

@angular/service-worker NPM version =20.0.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 Source cves: CVE-2026-50169 Source advisory: OSV:GHSA-GV2Q-MQQV-365M...

CVE-2026-49875

A flaw was found in Apache CXF. The EndpointReferenceUtils and W3CMultiSchemaFactory classes within Apache CXF construct a SAXParserFactory without proper security configurations. This oversight enables out-of-band OOB external entity resolution, a type of XML External Entity XXE vulnerability. A...

CVE-2026-12206 Grit42 Grit data_table_entity.rb DataTableEntity sql injection

A vulnerability was identified in Grit42 Grit up to 0.11.0. This issue affects the function Grit::Assays::DataTableEntity of the file modules/assays/backend/app/models/grit/assays/datatableentity.rb. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The...

[SECURITY] Fedora 43 Update: python-django5-5.2.15-1.fc43

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

[SECURITY] Fedora 44 Update: python-django5-5.2.15-1.fc44

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

PT-2026-49578

Name of the Vulnerable Software and Affected Versions React Router version 7 Description Insufficient Cross-Site Request Forgery CSRF checks in Framework Mode allow bypasses when using 'PUT', 'PATCH', or 'DELETE' requests, as the checks were primarily applied to 'POST' requests. CSRF is a type of...

PT-2026-49583

Name of the Vulnerable Software and Affected Versions Angular versions prior to 22.0.1 Angular versions prior to 21.2.17 Angular versions prior to 20.3.25 Description A Denial of Service DoS issue exists in the @angular/common package. The formatDate function, also used by the standard DatePipe,...