@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114144 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114144 Source advisory: GHSA-9QMH-M7C6-F92P...

@zone-eu/wild-config (>=1.7.6, <=1.7.7), @zone-eu/zone-mta (>=3.11.0, <=3.11.4) +3 more potentially affected by CVE-2026-114144 via toml (5.0.0)

toml NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @zone-eu/wild-config =1.7.6, =3.11.0, =2.13.0, =2.73.0, =1.1.7, =2.0.0 Source cves: CVE-2026-114144 Source advisory: OSV:GHSA-9QMH-M7C6-F92P...

Insecure Default Initialization of Resource

Overview @storybook/core-server is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved project config...

Insecure Default Initialization of Resource

Overview @storybook/experimental-addon-test is an Integrate Vitest with Storybook Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved...

Insecure Default Initialization of Resource

Overview @storybook/addon-vitest is a Storybook Vitest addon: Blazing fast component testing using stories Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not...

Insecure Default Initialization of Resource

Overview @storybook/core is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved project config when usi...

Insecure Default Initialization of Resource

Overview storybook is a frontend workshop for building UI components and pages in isolation. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the...

Insecure Default Initialization of Resource

Overview @storybook/addon-mcp is a Help agents automatically write and test stories for your UI components Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not...

SUSE CVE-2026-114718

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such...

SUSE CVE-2026-114719

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the uid parameter from POST data but passed it to rcmail::getuids without constraining the input mode, so values re-read inside that...

EUVD-2026-108228

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068 JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068 JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068

The JetBackup plugin for WordPress (versions before 3.1.24.10 ) is vulnerable to a symlink-based arbitrary file write flaw during the backup import and restore process. The root cause is the failure to validate symbolic links or enforce destination containment when extracting backup archives, all...

autohooks-plugin-black (21.7.0), cblack (21.6.0b0) +8 more potentially affected by CVE-2026-114134 +1 more via black (21.6.0b0)

black PYPI version 21.6.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - autohooks-plugin-black 21.7.0 - cblack 21.6.0b0 - coveo-stew =2.0.2, =0.9.0, =0.1.0, =0.2.0, =0.6.9, =0.10.16 - tomte 0.1.0 Source cves:...

aiosoma (1.1.18), candlestick-patterns (>=1.0.1, <=1.2.0) +3 more potentially affected by CVE-2026-114134 +1 more via black (23.12.0)

black PYPI version 23.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - aiosoma 1.1.18 - candlestick-patterns =1.0.1, =0.1.9, =2.97.0, =0.39.0, =0.39.6 Source cves: CVE-2026-114134, CVE-2026-31900 Source advisory:...

aiosoma (1.1.14), cloudquery-plugin-sdk (0.1.8) +3 more potentially affected by CVE-2026-114134 +1 more via black (23.10.1)

black PYPI version 23.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - aiosoma 1.1.14 - cloudquery-plugin-sdk 0.1.8 - fairprice =0.1.0, =2.90.0, =2.91.0 - misago 0.37.0 Source cves: CVE-2026-114134, CVE-2026-31900 Sourc...

aiosoma (>=1.1.9, <=1.1.11), amsdal-models (>=0.0.1, <=0.0.20) +12 more potentially affected by CVE-2026-114134 +1 more via black (23.9.1)

black PYPI version 23.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - aiosoma =1.1.9, =0.0.1, =1.0.0, =0.1.4, =0.4.9a2, =0.0.5, =2.84.0, =0.1.0, =0.1.0, =0.1.0, =2023.33.0, =2024.31.0 Source cves: CVE-2026-114134,...

3d-rcnet (>=0.2.2, <=0.2.3), 3lc (>=3.2.0, <=3.4.2) +2666 more potentially affected by CVE-2026-96641 via pillow (12.3.0)

pillow PYPI version 12.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3d-rcnet =0.2.2, =3.2.0, =0.4.0, =0.2.0, =0.2.0, =0.3.1, =0.2.0, =0.2.0, =0.2.0, =0.1.6, =0.1.0, =0.0.1, =0.5.0, =0.0.6, =0.25.1 and more Source...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), aerismodsdk (>=0.1.1, <=0.1.5) +678 more potentially affected by unknown CVE via pyjwt (1.7.1)

pyjwt PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.1.1, =1.6.2, =0.1.1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.92.5, =2021.5.0b9 - alastria-identity...