thymeleaf-check

thymeleaf-check ThymeleafCVE-2026-40477 / CVE-2026-41901 offline triage tool — zero dependencies, single jar, no network. Two CVSS 9.0 SSTI bypasses, with two fixed releases shipped within nine days. It first answers "which of these am I affected by," then answers the harder question: On my versi...

CVE-2026-88871

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...

CVE-2024-41808

The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. ...

EUVD-2024-0448

Malicious code in bioql PyPI...

CVE-2025-53925

CVE-2025-53925 affects Emlog up to version 2.5.17. A cross-site scripting (XSS) flaw exists in the file upload functionality that lets an authenticated user upload an SVG containing JavaScript, which can be executed in the victim’s context. The root cause is insufficient handling/cleanup of uploa...

CVE-2023-42443

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In version 0.3.9 and prior, under certain conditions, the memory used by the builtins rawcall, createfromblueprint and createcopyof can be corrupted. For rawcall, the argument buffer of the call can be corrupted,...

WordPress Chaty plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas Patchstack Alliance in WordPress Chaty plugin versions = 2.8.3. Solution No patched version is available...