CVE-2025-65122

Regex Denial of Service in youtube-regex npm package through version 1.0.5...

CVE-2026-40980

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper. Affected versions: Spring AI: 1.0.0 - 1.0.5 fixed in 1.0.6, 1.1.0 - 1.1.4 fixed in 1.1.5...

PT-2026-35667

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 1.0.5 Spring AI versions 1.1.0 through 1.1.4 Description Various FilterExpressionConverter implementations fail to properly escape keys and values when translating filter expression objects into specific vector...

EUVD-2026-25903

The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed Digest authentication attempts. By repeatedly sending RTSP requests with invalid authentication parameters, an unauthenticated attacker can cause the RTSP service to enter a persistent authentication...

MAL-2026-3030 Malicious code in model-poc-suhail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5632cd6f241c640005252e66d1d85f09ba30b019890cb696ada78760ed8e6fed Package ships poc.js which requires childprocess and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp.in.ngrok.io:10023. This giv...

EUVD-2026-20433

The pdfl.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pdflio' shortcode in all versions up to, and including, 1.0.5. This is due to insufficient input sanitization and output escaping on the 'text' shortcode attribute. The outputshortcode function directly...

Sumi Interactive GRID Organiser 安全漏洞

Sumi Interactive GRID Organizer is an activity planning and management application developed by Sumi Interactive in China. Versions of Sumi Interactive GRID Organizer prior to 1.0.5 contained security vulnerabilities, which were caused by the use of hardcoded encryption keys for the Parameter...

a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function

A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local position. The exploit has been made public and could be use...

CVE-2026-5323 priyankark a11y-mcp index.js A11yServer server-side request forgery

A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local position. The exploit has been made public and could be use...

A11y MCP Server 代码问题漏洞

A11y MCP Server is a web accessibility testing tool developed by Priyankar Kumar as an individual project. Versions of A11y MCP Server 1.0.5 and earlier contained code vulnerabilities. These vulnerabilities stemmed from a server-side request forgeing vulnerability in the A11yServer function locat...

EUVD-2026-17958

An unauthenticated remote code execution RCE vulnerability exists in applications that use the Replicator node package manager npm version 1.0.5 to deserialize untrusted user input and execute the resulting object...

Replicator deserializes untrusted user input

An unauthenticated Remote Code Execution RCE vulnerability exists in applications that use the Replicator node package manager npm version 1.0.5 to deserialize untrusted user input and execute the resulting object...

CVE-2026-2265

CVE-2026-2265 describes an unauthenticated remote code execution in applications using the Replicator npm package (version 1.0.5) due to deserializing untrusted input. The issue affects Replicator’s ability to deserialize objects, enabling an attacker to execute code remotely. Sources from multip...

PT-2026-29565

An unauthenticated remote code execution RCE vulnerability exists in applications that use the Replicator node package manager npm version 1.0.5 to deserialize untrusted user input and execute the resulting object...

replicator 安全漏洞

Replicator is a high-level JavaScript object serialization library developed by Ivan Nikulin. Version 1.0.5 of Replicator contains a security vulnerability that stems from deserializing untrusted user inputs, potentially allowing unauthorized remote code execution...

EUVD-2026-16541

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue inserts the value directly into the @field:VALUE RediSearch TAG block without escaping characters.This issue affects Spring AI: from 1.0.0 before 1.0....

VMware Spring AI 安全漏洞

VMware Spring AI is a development framework by the American company VMware, which integrates artificial intelligence and large language model capabilities into the Spring ecosystem. Versions prior to 1.0.5 and 1.1.4 of VMware Spring AI contained security vulnerabilities. These vulnerabilities...

EUVD-2026-15451

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Quick Edit allows Cross-Site Scripting XSS.This issue affects Quick Edit: from 0.0.0 before 1.0.5, from 2.0.0 before 2.0.1...

CVE-2026-2348

CVE-2026-2348 concerns a Cross-site Scripting (XSS) vulnerability in Drupal Quick Edit. The issue arises from improper input neutralization during web page generation, with the Quick Edit module failing to sanitize certain values, enabling XSS. Affected versions are Quick Edit: 0.0.0 before 1.0.5...

D-Link DIR-825和D-Link DIR-825R 操作系统命令注入漏洞

D-Link DIR-825 and D-Link DIR-825R are products of D-Link Corporation from China. The D-Link DIR-825 is a router, while the D-Link DIR-825R is a wireless router. Both models, D-Link DIR-825 and D-Link DIR-825R, in their version 1.0.5/4.5.1, have a vulnerability related to operating system command...