002-globals (=1.0.0), 007putra-my-bot (=1.1.1) +36331 more potentially affected by CVE-2026-6733 via undici (>=7.0.0 <=7.27.2)

undici NPM version =7.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =1.0.0, =0.3.96, =0.0.1, =0.0.9 - 2017-1535 =1.0.0 and more Source cves: CVE-2026-6733 Source advisory: OSV:GHSA-35P6-XMWP-9G52...

CVE-2026-49230 Apache APISIX: Authentication bypass in jwe-decrypt

Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authentication bypass. This issue affects Apache APISIX: from 3.8.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the...

CVE-2026-44915

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to phishing and credential theft. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0,...

CVE-2026-44915

CVE-2026-44915 is an Open Redirect vulnerability in Apache APISIX related to the cas-auth plugin in its default configuration. The issue affects Apache APISIX versions 3.0.0 through 3.16.0 and could enable phishing and credential theft. Apache recommends upgrading to version 3.17.0, which contain...

CVE-2026-47339

CVE-2026-47339 affects Apache APISIX (authz-casdoor plugin). Under default configuration, it allows an attacker to authenticate using credentials from a different source, indicating an incorrect authorization vulnerability across versions 2.14.1 through 3.16.0. The risk is described as high (per ...

CVE-2026-44046

Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac plugin under default configuration to potentially pollute logs with spoofed identity information and exploit IP based access control rules. This issue affects Apache APISIX: from 1.2.0 through...

PT-2026-50946

Name of the Vulnerable Software and Affected Versions GridTime 3000 versions 1.0r0.03 through 1.1r0.0 Description The GridTime 3000 GNSS Time Server leaks the access token within the URL parameters of certain endpoints. Recommendations Update GridTime 3000 versions 1.0r0.03 through 1.1r0.0 to a...

PT-2026-50948

Name of the Vulnerable Software and Affected Versions GridTime 3000 versions 1.0r0.03 through 1.1r0.0 Description The GridTime 3000 GNSS Time Server contains an open redirect issue within the password change form submission. An open redirect occurs when an application takes a user-provided URL an...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an out-of-memory condition in spdystream Go [CVE-2026-35469]

Summary IBM Watson Speech Services Cartridge is vulnerable to an out-of-memory condition in spdystream Go, caused by a flaw in SPDY/3 frame parser that does not validate attacker-controlled counts and lengths before allocating memory CVE-2026-35469. Spdystream Go is used in our speech utilities...

NPM: undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

NPM: undici vulnerable to cross-user information disclosure via shared cache whitespace bypass vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.28.0...

NPM: http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

NPM: http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in fixRequestBody vulnerability discovered by ? in WordPress Npm http-proxy-middleware versions = 3.0.4, 3.0.7...

@adyen/adyen-salesforce-pwa (>=2.0.0 <=3.0.4), @amazeelabs/publisher (>=2.4.28 <=3.2.6) +76 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=3.0.0 <=3.0.5)

http-proxy-middleware NPM version =3.0.0, =2.0.0, =2.4.28, =1.0.0, =0.9.1-next.19, =0.9.1-next.19, =0.9.1-next.19, =0.0.4, =3.0.0-alpha-1, =24.3.0-depup.0, =2.1.0-next.0, =2.1.0-next.0, =9.0.0, =9.0.0, =9.6.1 and more Source cves: CVE-2026-55602 Source advisory: SNYK:JS-HTTPPROXYMIDDLEWARE-173750...

NPM: http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass

NPM: http-proxy-middleware router host+path substring matching allows Host-header-driven backend routing bypass vulnerability discovered by ? in WordPress Npm http-proxy-middleware versions = 0.16.0, 2.0.10...

002-globals (=1.0.0), 007putra-my-bot (=1.1.1) +36331 more potentially affected by CVE-2026-11525 via undici (>=7.0.0 <=7.27.2)

undici NPM version =7.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =1.0.0, =0.3.96, =0.0.1, =0.0.9 - 2017-1535 =1.0.0 and more Source cves: CVE-2026-11525 Source advisory: SNYK:JS-UNDICI-17372758...

0utmailauth (=1.0.0), 0xkobold (>=0.0.1 <=0.8.0) +15496 more potentially affected by CVE-2026-11525 via undici (>=6.0.0 <=6.26.0)

undici NPM version =6.0.0, =0.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.1, =1.0.68, =4.11.0, =4.11.46 - 7up-dev =1.0.0 - 7up-developer =1.0.0 - 7up-kingdom =1.0.0 - 7up-nub =1.0.0 and more Source cves: CVE-2026-11525 Source advisory: SNYK:JS-UNDICI-17372758...

002-globals (=1.0.0), 007putra-my-bot (=1.1.1) +36331 more potentially affected by CVE-2026-6733 via undici (>=7.0.0 <=7.27.2)

undici NPM version =7.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =1.0.2, =1.0.0, =1.0.0, =0.3.96, =0.0.1, =0.0.9 - 2017-1535 =1.0.0 and more Source cves: CVE-2026-6733 Source advisory: SNYK:JS-UNDICI-17372752...

02url-querystring-http (>=1.0.1 <=1.0.4), 04_nodeblog (=1.0.0) +15347 more potentially affected by CVE-2026-5079 via multer (>=1.0.3 <=2.1.1)

multer NPM version =1.0.3, =1.0.1, =1.0.5, =2.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.3 and more Source cves: CVE-2026-5079 Source advisory: OSV:GHSA-72GW-MP4G-V24J...

NPM: Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory

NPM: Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory vulnerability discovered by ? in WordPress Npm chrome-devtools-mcp versions = 0.20.0, = 1.0.1...

EUVD-2025-210248

Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n/a through 1.2.3...

CVE-2026-46880

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Enterprise Infrastructure Security. Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via JDENET to compromise ...