CVE-2026-115366

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...

CVE-2026-115366 OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...

EUVD-2026-108291

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...

CVE-2026-115366 OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...

CVE-2026-115366

Versions 2.3.0 through 2.6.3 of OpenBao are vulnerable to an improper authorization flaw. The issue arises because the /v1/sys/plugins/catalog/* API endpoint is not restricted to the root namespace, allowing privileged child-namespace tokens to modify plugin registrations. An attacker can leverag...

CVE-2026-115366 OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs

OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin registrations because /v1/sys/plugins/catalog/ is not restricted to the root namespace. Attackers can remove existing registrations, create invalid ones,...

CVE-2026-104068

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

autocleus (0.1.1), poetry (>=1.2.0a1, <=1.2.0a2) +2 more potentially affected by CVE-2026-113721 via virtualenv (20.4.4)

virtualenv PYPI version 20.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - autocleus 0.1.1 - poetry =1.2.0a1, =0.1.2, =0.0.1, =0.4.1 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114142 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114142 Source advisory: OSV:GHSA-H895-CGQG-JF52...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114142 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114142 Source advisory: SNYK:JS-TOML-21431470...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114141 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114141 Source advisory: OSV:GHSA-4QX8-W7C3-PJ3P...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114141 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114141 Source advisory: SNYK:JS-TOML-21431462...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114143 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114143 Source advisory: SNYK:JS-TOML-21431464...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114143 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114143 Source advisory: OSV:GHSA-9J65-HCG3-GC64...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114144 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114144 Source advisory: GHSA-9QMH-M7C6-F92P...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114144 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114144 Source advisory: OSV:GHSA-9QMH-M7C6-F92P...

Insecure Default Initialization of Resource

Overview @storybook/addon-vitest is a Storybook Vitest addon: Blazing fast component testing using stories Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not...

Insecure Default Initialization of Resource

Overview storybook is a frontend workshop for building UI components and pages in isolation. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the...

Insecure Default Initialization of Resource

Overview @storybook/core is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved project config when usi...

Insecure Default Initialization of Resource

Overview @storybook/core-server is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved project config...