Insecure Default Initialization of Resource

Overview @storybook/experimental-addon-test is an Integrate Vitest with Storybook Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved...

Insecure Default Initialization of Resource

Overview @storybook/addon-mcp is a Help agents automatically write and test stories for your UI components Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not...

SUSE CVE-2026-114718

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such...

SUSE CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

EUVD-2026-108228

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068 JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068 JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068

The JetBackup plugin for WordPress (versions before 3.1.24.10 ) is vulnerable to a symlink-based arbitrary file write flaw during the backup import and restore process. The root cause is the failure to validate symbolic links or enforce destination containment when extracting backup archives, all...

autohooks-plugin-black (21.7.0), cblack (21.6.0b0) +8 more potentially affected by CVE-2026-114134 +1 more via black (21.6.0b0)

black PYPI version 21.6.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - autohooks-plugin-black 21.7.0 - cblack 21.6.0b0 - coveo-stew =2.0.2, =0.9.0, =0.1.0, =0.2.0, =0.6.9, =0.10.16 - tomte 0.1.0 Source cves:...

aiosoma (1.1.18), candlestick-patterns (>=1.0.1, <=1.2.0) +3 more potentially affected by CVE-2026-114134 +1 more via black (23.12.0)

black PYPI version 23.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - aiosoma 1.1.18 - candlestick-patterns =1.0.1, =0.1.9, =2.97.0, =0.39.0, =0.39.6 Source cves: CVE-2026-114134, CVE-2026-31900 Source advisory:...

aiosoma (>=1.1.9, <=1.1.11), amsdal-models (>=0.0.1, <=0.0.20) +12 more potentially affected by CVE-2026-114134 +1 more via black (23.9.1)

black PYPI version 23.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - aiosoma =1.1.9, =0.0.1, =1.0.0, =0.1.4, =0.4.9a2, =0.0.5, =2.84.0, =0.1.0, =0.1.0, =0.1.0, =2023.33.0, =2024.31.0 Source cves: CVE-2026-114134,...

aiosoma (1.1.14), cloudquery-plugin-sdk (0.1.8) +3 more potentially affected by CVE-2026-114134 +1 more via black (23.10.1)

black PYPI version 23.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - aiosoma 1.1.14 - cloudquery-plugin-sdk 0.1.8 - fairprice =0.1.0, =2.90.0, =2.91.0 - misago 0.37.0 Source cves: CVE-2026-114134, CVE-2026-31900 Sourc...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +2666 more potentially affected by CVE-2026-96641 via pillow (12.3.0)

pillow PYPI version 12.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3d-rcnet =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), aerismodsdk (>=0.1.1, <=0.1.5) +678 more potentially affected by unknown CVE via pyjwt (1.7.1)

pyjwt PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.1.1, =1.6.2, =0.1.1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.92.5, =2021.5.0b9 - alastria-identity...

OESA-2026-4425 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dcs in WordPress Plugin WpEvently versions = 5.7.8...

CVE-2026-13411

Mattermost versions 11.7.x = 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709...

CVE-2017-20289

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

EUVD-2017-19026

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

CVE-2026-13411 Null condition in Playbooks import crashes the plugin

Mattermost versions 11.7.x = 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709...