Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the rest integration process. An attacker can obtain sensitive authentication credentials by supplying a crafted absolute URL as a query parameter, causing the system to...

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by exploiting DNS rebinding to bypass outbound fetch...

CVE-2026-65710

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the JNX decoder. An attacker can cause a heap buffer over-write by processing extremely large files on 32-bit builds. Remediation A fix was pushed into the master branch but not yet published. Reference...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the fx operation. An attacker can cause a denial of service by passing a specially crafted argument. Remediation A fix was pushed into the master branch but not yet published. References - GitHub Advisory - GitHu...

CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

EUVD-2026-48716

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the HTML encoding. An attacker can execute arbitrary code by supplying specially crafted input that is not properly sanitized. Remediation A fix was pushed into the master branch but not y...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to an incomplete fix in the policy. An attacker can gain unauthorized access to restricted functionality or data by bypassing intended security policies. Remediation A fix was pushed into the master branch bu...

CVE-2026-65454

Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

ImpactLiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In...

PYSEC-2026-3478 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In...

CVE-2026-65454 WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability

Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...

EUVD-2026-48219

Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...

CVE-2026-65454 WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability

Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...

CVE-2026-65454

The CVE-2026-65454 entry concerns the WordPress plugin Quiz And Survey Master (

CVE-2026-7534

The CVE-2026-7534 entry details a vulnerability in the SUMO Reward Points for WooCommerce plugin (WordPress) up to version 32.7.0. Affected component: SRP_REST_Earning_Controller handling REST endpoint /wp-json/wc-srp/v1/earning. Root cause: the user_has_cap filter unconditionally grants the rs_e...

CVE-2026-7534

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...

PT-2026-63877

Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...

PT-2026-64088

Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In...