CVE-2025-14755 Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference IDOR in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccbwoocommercepayment AJAX...

CVE-2025-14755

The Cost Calculator Builder plugin for WordPress (

EUVD-2026-29886

The MonsterInsights – Google Analytics Dashboard for WordPress Website Stats Made Easy plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability checks on the getadsaccesstoken and resetexperience functions in all versions up to, and including,...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site Scripting issue in Analytics dashboard chart rendering impacts GitLab EE Cross-site Scripting issue in global search impacts GitLab CE/EE Cross-site Scripting issue in Duo Agent output rendering impacts GitLab EE Cross-site Scripting issue in Analytics Dashboard impacts...

Hitachi Vantara Pentaho Data Integration and Analytics 安全漏洞

Hitachi Vantara Pentaho Data Integration and Analytics is a business intelligence dashboard designer developed by the American company Hitachi Vantara. There is a security vulnerability in Hitachi Vantara Pentaho Data Integration and Analytics, which stems from the JDBC driver of the H2 database,...

PT-2026-40566

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Data Integration & Analytics affected versions not specified Description The software contains a JDBC driver for H2 databases that allows external script execution. This occurs when a data source administrator creates a...

CVE-2025-11159: Dependency on Vulnerable Third-Party Component

Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator...

Joern 4.0.538

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

PT-2026-40730

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 0.0.0-20260421031503-96dfe0bea474 Description A stored cross-site scripting XSS issue exists in the Bazaar marketplace. The application fails to sanitize the name and version fields in package metadata files such as...

Context-Aware Web Attack Detection in Open-Source SIEM Systems Via MITRE ATT&CK-Enriched Behavioral Profiling

Security Information and Event Management SIEM systems aggregate log data from heterogeneous sources to detect coordinated attacks. Traditional rule-based correlation engines struggle to classify multi-step web application attacks because they examine each event without reference to the behaviour...

cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names

A flaw was found in the Go programming language golang and its command-line tool cmd/go. A remote attacker could exploit this during the build process by crafting malicious SWIG Simplified Wrapper and Interface Generator file names that contain "cgo" and specific payloads. This could lead to code...

CVE-2026-5371

The MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy) plugin for WordPress is vulnerable through missing capability checks on get_ads_access_token() and reset_experience() in all versions up to 10.1.2. The issue allows authenticated attackers with Subscriber-lev...

CVE-2026-5371 MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset

The MonsterInsights – Google Analytics Dashboard for WordPress Website Stats Made Easy plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability checks on the getadsaccesstoken and resetexperience functions in all versions up to, and including,...

CVE-2026-5371 MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset

The MonsterInsights – Google Analytics Dashboard for WordPress Website Stats Made Easy plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability checks on the getadsaccesstoken and resetexperience functions in all versions up to, and including,...

io.sniffy:sniffy-integration-tests-tomcat (>=3.1.10, <=3.1.14), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.107) +2 more potentially affected by CVE-2026-43514 via org.apache.tomcat.embed:tomcat-embed-core (7.0.107)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.107 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.sniffy:sniffy-integration-tests-tomcat =3.1.10, =3.15.3, =3.16.8 Source...

io.sniffy:sniffy-integration-tests-tomcat (>=3.1.10, <=3.1.14), org.apache.tomcat.embed:tomcat-embed-jasper (7.0.107) +2 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (7.0.107)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.107 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - io.sniffy:sniffy-integration-tests-tomcat =3.1.10, =3.15.3, =3.16.8 Source...

com.ovea.tajin.server:tajin-server-jetty8 (>=1.0.b1, <=1.0.b11), com.ovea.tajin.server:tajin-server-jetty9 (>=1.0.b1, <=1.0.b11) +10 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (7.0.8)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.ovea.tajin.server:tajin-server-jetty8 =1.0.b1, =1.0.b1, =4.7.1, =3.2.1, =1.2.0.beta1,...

com.amazonaws:aws-dynamodb-session-tomcat (2.0.4), org.apache.tomcat:tomcat-catalina-ha (8.0.1) +3 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (8.0.1)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.amazonaws:aws-dynamodb-session-tomcat 2.0.4 - org.apache.tomcat:tomcat-catalina-ha 8.0.1 ...

com.ovea.tajin.server:tajin-server-jetty8 (>=1.0.b1, <=1.0.b11), com.ovea.tajin.server:tajin-server-jetty9 (>=1.0.b1, <=1.0.b11) +10 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (7.0.8)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.ovea.tajin.server:tajin-server-jetty8 =1.0.b1, =1.0.b1, =4.7.1, =3.2.1, =1.2.0.beta1,...

com.spatineo:geoserver-tomcat8-valve (1.0), org.apache.tomcat:tomcat-catalina-ha (8.5.46) +10 more potentially affected by CVE-2026-41284 via org.apache.tomcat:tomcat-catalina (8.5.46)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.46 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.spatineo:geoserver-tomcat8-valve 1.0 - org.apache.tomcat:tomcat-catalina-ha 8.5.46 -...