uTLS security vulnerability

uTLS is an open-source Go language codebase developed by Refraction Networking. Versions 1.6.0 to 1.8.0 of uTLS contain security vulnerabilities. These vulnerabilities stem from inconsistent password selection logic when using GREASE ECH, which may lead to fingerprint mismatches...

Cilium security vulnerabilities

Cilium is an open-source software developed by Cilium contributors. It is used to provide and transparently protect network connections and load balancing between application workloads, such as application containers or processes. Versions of Cilium from 1.18.0 to 1.18.5 contain security...

Netgear WiFi Range Extender Authentication Bypass

The vulnerability of the graphical interface of Netgear WiFi Range Extender software-related microprogramming devices is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibilit...

LibreNMS security vulnerabilities

LibreNMS is an open-source network monitoring system developed by the LibreNMS community, based on PHP and MySQL. This system features custom alerts, automatic discovery of networks, and automatic updates. There were security vulnerabilities in LibreNMS versions 24.10.0 to 26.1.1. These...

Netgear WiFi Range Extender Authentication Bypass

The vulnerability of the graphical interface of Netgear WiFi Range Extender software-related microprogramming devices is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibilit...

CVE-2026-26323 OpenClaw has a command injection in maintainer clawtributors updater

OpenClaw is a personal AI assistant. Versions 2026.1.8 through 2026.2.13 have a command injection in the maintainer/dev script scripts/update-clawtributors.ts. The issue affects contributors/maintainers or CI who run bun scripts/update-clawtributors.ts in a source checkout that contains a malicio...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +8 more potentially affected by CVE-2026-25940 via jspdf (>=4.0.0, <=4.1.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves: CVE-2026-25940 Source advisory: OSV:GHSA-P5XG-68WR-HM3M...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +8 more potentially affected by CVE-2026-25755 via jspdf (>=4.0.0, <=4.1.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves: CVE-2026-25755 Source advisory: OSV:GHSA-9VJF-QC39-JPRP...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +8 more potentially affected by CVE-2026-25755 via jspdf (>=4.0.0, <=4.1.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves: CVE-2026-25755 Source advisory: SNYK:JS-JSPDF-15322679...

@budibase/server (>=3.32.1, <=3.38.1), @burger-editor/client (>=4.0.0-alpha.26, <=4.0.0-alpha.61) +19 more potentially affected by CVE-2026-27119 via svelte (>=5.39.5, <=5.51.2)

svelte NPM version =5.39.5, =3.32.1, =4.0.0-alpha.26, =0.15.0-beta.2, =6.0.0, =2.4.0, =1.17.2, =0.1.2-alpha.1, =0.4.11, =0.4.12 - dumbo-svelte 0.3.0 and more Source cves: CVE-2026-27119 Source advisory: SNYK:JS-SVELTE-15322810...

CVE-2025-8350

Execution After Redirect EAR, Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting. This issue affects BiEticaret CMS: from 2.1.13 through 19022026. NOTE: The vendor was contacted...

CVE-2025-9062

Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection. This issue affects Envanty: before 1.0.6. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The...

WordPress plugin IDonate authorization issue vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-20948

Name of the Vulnerable Software and Affected Versions OpenText Directory Services versions 20.4.1 through 25.2 Description A flaw exists within the User Interface UI of OpenText Directory Services that can lead to a misrepresentation of critical information, specifically enabling cache poisoning...

WordPress plugins: Tablesome Table, Contact Form DB (WPForms, CF7, Gravity, Forminator, Fluent) – Security vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

@0zd0/nx-oxfmt (>=0.0.1, <=0.1.1), @10xly/eslint-config (>=1.0.0, <=1.0.8) +1097 more potentially affected by CVE-2026-26996 via minimatch (>=10.0.0, <=10.1.3)

minimatch NPM version =10.0.0, =0.0.1, =1.0.0, =6.0.0-test.1, =10.0.0, =10.0.0, =8.0.1, =13.0.0, =5.1.3, =0.2.0, =0.5.1-alpha.0, =4.10.0, =0.0.0-next-023d8d0, =0.0.0-next-023d8d0, =2.32.1 and more Source cves: CVE-2026-26996 Source advisory: SNYK:JS-MINIMATCH-15309438...

@adobe-apimesh/mesh-builder (1.4.0-beta.5), @akylas/nativescript-cli (>=8.7.2, <=8.8.2) +320 more potentially affected by CVE-2026-26996 via minimatch (>=7.0.0, <=7.4.6)

minimatch NPM version =7.0.0, =8.7.2, =5.5.0-682, =0.0.6, =3.6.0-next.1592614713.e5a4c4ab6a0ebf5dabac13d0a67422c28ed97f47, =2.6.0-next.1592627998.ea50ce98dfc72570fa6223d6c3754d6008fedd71, =2.5.0-next.1592629701.b7cf67ae0ec0a60f7a9abacdde474cb691004fe0,...

7ghost-cli (>=1.17.6-next.0, <=1.18.4), @agentuity/evals (>=0.0.104, <=2.0.30) +384 more potentially affected by CVE-2026-26280 via systeminformation (>=5.0.6, <=5.30.7)

systeminformation NPM version =5.0.6, =1.17.6-next.0, =0.0.104, =3.0.0-alpha.0, =0.0.6, =0.0.63, =0.0.2, =3.0.0-alpha.0, =0.26.4, =0.1.1, =0.1.1, =4.1.0-rc.4, =5.2.0-revision.1, =0.0.1-2.1-beta-provision, =1.0.10, =1.0.87 and more Source cves: CVE-2026-26280 Source advisory: OSV:GHSA-9C88-49P5-5G...

7ghost-cli (>=1.17.6-next.0, <=1.18.4), @agentuity/evals (>=0.0.104, <=2.0.30) +384 more potentially affected by CVE-2026-26280 via systeminformation (>=5.0.6, <=5.30.7)

systeminformation NPM version =5.0.6, =1.17.6-next.0, =0.0.104, =3.0.0-alpha.0, =0.0.6, =0.0.63, =0.0.2, =3.0.0-alpha.0, =0.26.4, =0.1.1, =0.1.1, =4.1.0-rc.4, =5.2.0-revision.1, =0.0.1-2.1-beta-provision, =1.0.10, =1.0.87 and more Source cves: CVE-2026-26280 Source advisory:...

Ghost has a SQL injection in Content API

Impact A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. Vulnerable Versions This vulnerability is present in Ghost v3.24.0 to v6.19.0. Patches v6.19.1 contains a fix for this issue. Note: as this...