org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-69190 Source advisory: OSV:GHSA-M9C2-85GV-8XR5...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-69190 Source advisory: SNYK:JAVA-ORGGRAYLOG2-20079479...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-69190 Source advisory: GHSA-M9C2-85GV-8XR5...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (6.3.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (6.3.0) +3 more potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=6.3.0, <=6.3.13)

org.graylog2:graylog2-server MAVEN version =6.3.0, =6.3.0, =6.3.0, =6.3.13 Source cves: CVE-2026-69190 Source advisory: GHSA-M9C2-85GV-8XR5...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (7.0.0) +3 more potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.0.0, <=7.0.8)

org.graylog2:graylog2-server MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.0.8 Source cves: CVE-2026-69190 Source advisory: OSV:GHSA-M9C2-85GV-8XR5...

barrelly (>=1.0.0, <=1.2.0), rsbuild-plugin-wasmpack (>=0.0.4, <=2.0.0) potentially affected by CVE-2026-63386 via js-toml (>=1.0.0, <=1.1.0)

js-toml NPM version =1.0.0, =1.0.0, =0.0.4, =2.0.0 Source cves: CVE-2026-63386 Source advisory: MEND:CVE-2026-63386...

Improper Authorization

Overview @tauri-apps/plugin-updater is a Affected versions of this package are vulnerable to Improper Authorization via the allowDowngrades option exposed to the frontend JavaScript API, which allowed any web content running inside a Tauri application to request installation of an older, previous...

@crabnebula/taurify-api (>=0.1.0, <=0.1.3), @huakunshen/kunkun-ip-info (0.0.7) +8 more potentially affected by CVE-2026-95624 via @tauri-apps/plugin-updater (>=2.0.0-beta.3, <=2.10.1)

@tauri-apps/plugin-updater NPM version =2.0.0-beta.3, =0.1.0, =0.0.1-alpha.0, =0.0.2, =0.2.33, =0.1.1, =0.0.2-alpha.0, =0.0.2-alpha.18 - kksh 0.0.23 - kunkun-ext-letterboxd 0.0.3 Source cves: CVE-2026-95624 Source advisory: SNYK:JS-TAURIAPPSPLUGINUPDATER-20078986...

CVE-2026-95624

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

CVE-2026-85279

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount result controls a loop that writes to...

Malicious Package

Overview eslint-plugin-i18n-shreddit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @wizloft/harness-plugin-memory-context is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview @wizloft/harness-plugin-file-events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview @wizloft/harness-plugin-file-memory is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

CVE-2026-95624 Tauri framework v2 malicious downgrade via allow_downgrades from frontend code

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

CVE-2026-95624

The Tauri updater plugin is vulnerable to a malicious downgrade attack because the 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When this parameter is set to true , it changes the version comparator from "update must be newer" to "update...

EUVD-2026-84577

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

CVE-2026-95624 Tauri framework v2 malicious downgrade via allow_downgrades from frontend code

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

CVE-2026-95624 Tauri framework v2 malicious downgrade via allow_downgrades from frontend code

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...

EUVD-2026-84533

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Apache Calcite Avatica. Plugin instantiation via AvaticaUtilsinstantiatePlugin and other methods initializes arbitrary classes via unrestricted calls to Class.forNameString which by default triggers...