EUVD-2026-31000

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7...

Sitemio WISECP 跨站请求伪造漏洞

Sitemio WISECP is an automated management and billing platform developed by the Turkish company Sitemio, aimed at hosting services and domain name services. Versions of Sitemio WISECP from 2002 to 2026 had a cross-site request forgeing vulnerability. This vulnerability stems from cross-site reque...

NLnet Labs Unbound 资源管理错误漏洞

NLnet Labs Unbound is a high-performance DNS resolver open-sourced by NLnet Labs. In versions 1.19.1 to 1.25.0 of NLnet Labs Unbound, there is a resource management vulnerability. This vulnerability stems from incorrect overwriting of target pointers when deep copying data structures in the DNSSE...

CLSA-2026-1779223801 samba: Fix of CVE-2022-32742

CVE-2022-32742: fix server memory information leak via SMB1; insufficient range-check on SMB1 write request length allowed server memory contents to leak into the written file or printer instead of client-supplied bytes...

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

Summary dasel's selector lexer panics with an index-out-of-range error when tokenizing a quoted string that ends with a trailing backslash e.g., "\ or '. A 2-byte input causes an immediate process crash via Go runtime panic. I confirmed the issue on v3.3.1 fba653c7f248aff10f2b89fca93929b64707dfc8...

GHSA-M5J3-4634-C2VQ Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

Summary dasel's selector lexer panics with an index-out-of-range error when tokenizing a quoted string that ends with a trailing backslash e.g., "\ or '. A 2-byte input causes an immediate process crash via Go runtime panic. I confirmed the issue on v3.3.1 fba653c7f248aff10f2b89fca93929b64707dfc8...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +16 more potentially affected by CVE-2026-46342 via @nuxt/nitro-server (>=4.2.0, <=4.4.5)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =0.4.5, =3.0.0-dev.27, =4.2.0, =0.5.0, =1.0.1, =0.4.0, =0.1.13, =0.2.2 and more Source cves: CVE-2026-46342 Source advisory: OSV:GHSA-G8WJ-3CR3-6W7V...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +16 more potentially affected by CVE-2026-46342 via @nuxt/nitro-server (>=4.2.0, <=4.4.5)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =0.4.5, =3.0.0-dev.27, =4.2.0, =0.5.0, =1.0.1, =0.4.0, =0.1.13, =0.2.2 and more Source cves: CVE-2026-46342 Source advisory: SNYK:JS-NUXTNITROSERVER-16770417...

@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @142vip/fairy-cli (>=0.0.3-alpha.19, <=0.0.3-alpha.28) +64 more potentially affected by CVE-2026-45772 via turbo (>=1.3.1, <=2.9.12)

turbo NPM version =1.3.1, =4.2.1, =0.0.3-alpha.19, =1.0.0, =1.6.0, =0.3.0, =0.0.1, =0.1.0, =2.0.5, =0.1.0, =0.1.0, =0.4.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-45772 Source advisory: OSV:GHSA-3QCW-2RHX-2726...

NPM: Turbo: Unexpected local code execution during Yarn Berry detection

NPM: Turbo: Unexpected local code execution during Yarn Berry detection vulnerability discovered by ? in WordPress Npm turbo versions = 1.1.0, 2.9.14...

armature-diesel (0.1.0), aruna_policy (>=0.1.0, <=0.1.2) +112 more potentially affected by unknown CVE via diesel (>=2.0.0, <=2.3.4)

diesel CARGO version =2.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.1.0, =0.0.6, =0.1.1, =0.1.5, =0.1.0, =0.1.2, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q8X8-JRHJ-FH9P...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1045 more potentially affected by CVE-2026-45740 via protobufjs (>=8.0.0, <=8.0.3)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 and more Source cves: CVE-2026-45740 Source advisory: OSV:GHSA-JGGG-4JG4-V7C6...

[SECURITY] Fedora 43 Update: perl-Net-CIDR-Lite-0.24-1.fc43

Faster alternative to Net::CIDR when merging a large number of CIDR address ranges. Works for IPv4 and IPv6 addresses...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +53 more potentially affected by CVE-2026-45669 via nuxt (>=3.4.3, <=3.20.1)

nuxt NPM version =3.4.3, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.12.0-rc.7 and more Source cves: CVE-2026-45669 Source advisory: OSV:GHSA-FX6J-W5W5-H468...

CVE-2026-45442

Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Presto Player: from n/a through 4.1.3...

PT-2026-41761

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vulnerable to an unauthenticated Denial of Service DoS through the server due to uncontrolled disk space consumption. The download agent fil...

PT-2026-42044

Name of the Vulnerable Software and Affected Versions dasel versions 3.0.0 through 3.3.1 Description The selector lexer contains a flaw that causes a process crash via a Go runtime panic when tokenizing a quoted string that ends with a trailing backslash. This occurs because the escape sequence...

Drupal core 跨站脚本漏洞

Drupal Core is a free, open-source content management system developed in PHP by the Drupal community. Drupal Core has a cross-site scripting vulnerability, which stems from improper input during the web page generation process, potentially leading to cross-site scripting attacks. The following...

VulnCheck KEV: CVE-2025-62481

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite component: Marketing Administration. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing...

CVE-2026-30950 AutoGPT has Authenticated Session Hijacking via IDOR

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.6.36 through 0.6.50 are vulnerable to Authenticated Session Hijacking via IDOR. If an authenticated attacker can determine the sessionid of another user's session,...