CVE-2026-24762

RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material access key, secret key, session token to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be...

CVE-2026-25122 apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copyio.Discard, gzi without explicit bounds. With an attacker-controlled input stream, this can force lar...

CVE-2026-23624

GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used, based on SSO variables, a user can steal a GLPI session previously opened by another user on the same machine. This issue has been patch...

UBUNTU-CVE-2026-22247

GLPI is a free asset and IT management software package. From version 11.0.0 to before 11.0.5, a GLPI administrator can perform SSRF request through the Webhook feature. This issue has been patched in version 11.0.5...

UBUNTU-CVE-2026-22044

GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23...

@n8n/backend-test-utils (>=1.0.0-rc.0, <=1.0.3), @n8n/db (>=1.0.0-rc.0, <=1.0.3) +2 more potentially affected by CVE-2026-25051 via n8n-core (>=2.0.0, <=2.0.2)

n8n-core NPM version =2.0.0, =1.0.0-rc.0, =1.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.1 Source cves: CVE-2026-25051 Source advisory: SNYK:JS-N8NCORE-15223562...

4m-node-server (>=0.0.1, <=0.0.8), @2109-t5/server (>=1.0.0, <=1.0.9) +989 more potentially affected by CVE-2026-23897 via apollo-server (>=0.1.5, <=3.13.0)

apollo-server NPM version =0.1.5, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.1, =0.0.1, =1.0.7, =0.4.0-alpha.0, =10.4.0, =9.0.0, =10.0.0, =11.2.0 and more Source cves: CVE-2026-23897 Source advisory: SNYK:JS-APOLLOSERVER-15208674...

@24hr/rawb-search (>=0.5.0, <=0.29.10), @a11ywatch/a11ywatch (>=0.0.1, <=0.3.82) +574 more potentially affected by CVE-2026-23897 via apollo-server (>=2.0.0, <=3.12.0)

apollo-server NPM version =2.0.0, =0.5.0, =0.0.1, =0.1.1, =0.4.0-alpha.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.3.0-SNAPSHOT1, =0.3.0-SNAPSHOT1, =0.4.3, =2018.8.29-0, =2018.8.28-0, =2018.10.8-2 and more Source cves: CVE-2026-23897 Source advisory: OSV:GHSA-MP6Q-XF9X-FWF7...

CVE-2026-21893

n8n is an open source workflow automation platform. From version 0.187.0 to before 1.120.3, a command injection vulnerability was identified in n8n’s community package installation functionality. The issue allowed authenticated users with administrative permissions to execute arbitrary system...

CVE-2025-6596

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vecto...

n8n 操作系统命令注入漏洞

n8n is an open-source, scalable workflow automation tool developed by n8n. In versions 0.187.0 to 1.120.3, there was a vulnerability related to operating system command injection. This vulnerability stemmed from the community package installation feature’s command injection capability, which coul...

SUSE SLES16 Security Update : jasper (SUSE-SU-2026:20200-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20200-1 advisory. Update to 4.2.8: - CVE-2025-8837: Fixed a bug in the JPC decoder that could cause bad memory accesses if the debug level is set...

apko 安全漏洞

Apko is an open-source OCI image builder based on APK. Versions of Apko from 0.14.8 to 1.1.1 contained security vulnerabilities. These vulnerabilities stemmed from a path traversal vulnerability in the dirFS file system abstraction layer, which could lead to the creation of directories or symboli...

apko 资源管理错误漏洞

Apko is an open-source OCI image builder based on APK. In versions 0.14.8 to 1.1.0 of Apko, there was a resource management vulnerability. This vulnerability stemmed from the expandapk.Split function, which did not set clear boundaries when processing APK archives, potentially leading to resource...

CVE-2026-25547: Inefficient Regular Expression Complexity

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service DoS issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, t...

PT-2026-5867

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 2.1.0 Description The software does not invalidate user sessions after logout. This could allow an authenticated user to impersonate another user on the system. Recommendations Update to a version later than...

PT-2026-6102

Name of the Vulnerable Software and Affected Versions GLPI versions 0.85 through 10.0.22 Description GLPI is an asset and IT management software package. An authenticated user can perform a SQL injection. This allows for potential unauthorized access or modification of data within the system...

CVE-2025-33081

IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user...

CVE-2025-33081

IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user...

@react-portable/core (>=0.4.0, <=0.11.2), storybook-framework-qwik (>=0.3.0, <=0.4.0) potentially affected by CVE-2026-25150 via @builder.io/qwik-city (>=1.2.6, <=1.4.1)

@builder.io/qwik-city NPM version =1.2.6, =0.4.0, =0.3.0, =0.4.0 Source cves: CVE-2026-25150 Source advisory: SNYK:JS-BUILDERIOQWIKCITY-15202068...