CVE-2026-15972

The CVE affects Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2, with an unauthenticated denial of service caused by unbounded connection acceptance on external gRPC listeners. The root cause is unbounded resource usage from opening many incomplete connections, leading to exha...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-18446 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-18446 Source advisory: SNYK:JS-FASTURI-18506908...

@aegis-scan/core (>=0.18.1, <=0.19.0), @aegis-scan/reporters (>=0.18.4, <=0.19.0) +376 more potentially affected by CVE-2026-6734 via undici (>=7.24.0, <=7.27.2)

undici NPM version =7.24.0, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.1.8, =0.1.7, =21.2.4, =21.2.4, =0.1.0, =0.18.0, =0.1.0, =0.4.0, =0.1.0, =0.0.1, =0.1.2 and more Source cves: CVE-2026-6734 Source advisory: OSV:GHSA-HM92-R4W5-C3MJ...

Buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module

Buffer overflow in the ngxhttpproxyv2module and ngxhttpgrpcmodule Severity: medium CVE-2026-42055 Not vulnerable: 1.31.2+, 1.30.3+ Vulnerable: 1.13.10-1.31.1...

Exploit for CVE-2026-42926

CVE-2026-42926 NGINX HTTP/2 Frame Injection Lab A controlled...

31g-form-parser (1.0.107), @accounter/client (>=0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, <=0.0.12-alpha-20260508071110-20f5becdec9522d09c6a97f123f7c572407661fb) +374 more potentially affected by CVE-2026-42342 via react-router (>=7.0.0, <=7.14.2)

react-router NPM version =7.0.0, =0.0.3-alpha-20241124130832-1498e8a00d2fa532e452b5ad126a753f4844a237, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =3.4.0, =2026.511.1, =0.2.3, =0.3.7 and more Source cves: CVE-2026-42342 Source advisory: SNYK:JS-REACTROUTER-17138701...

Buffer overflow in the ngx_http_rewrite_module

Buffer overflow in the ngxhttprewritemodule Severity: medium CVE-2026-9256 Not vulnerable: 1.31.1+, 1.30.2+ Vulnerable: 0.1.17-1.31.0...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6322 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6322 Source advisory: SNYK:JS-FASTURI-16642394...

org.webjars.npm:compression-webpack-plugin (7.1.1), org.webjars.npm:copy-webpack-plugin (>=4.3.1, <=4.6.0) +9 more potentially affected by CVE-2026-34043 via org.webjars.npm:serialize-javascript (>=1.9.1, <=6.0.2)

org.webjars.npm:serialize-javascript MAVEN version =1.9.1, =4.3.1, =5.2.0, =1.1.6, =2.3.4, =2.5.17-beta.0 Source cves: CVE-2026-34043 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15809197...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +146 more potentially affected by CVE-2026-33287 via liquidjs (>=10.2.0, <=10.25.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =12.0.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.11.0-rc.0, =0.9.33, =1.0.0, =1.0.10 and more Source cves: CVE-2026-33287 Source advisory: SNYK:JS-LIQUIDJS-15767938...

OCSP result bypass in stream

OCSP result bypass in stream Severity: medium CVE-2026-28755 Not vulnerable: 1.29.7+, 1.28.3+ Vulnerable: 1.27.2-1.29.6...

@abiswas97/postgres-mcp (2.0.0), @ampt/sql (1.0.1) +743 more potentially affected by CVE-2026-33468 via kysely (>=0.3.9, <=0.28.13)

kysely NPM version =0.3.9, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =0.0.1, =0.0.0, =0.1.0, =0.0.2, =0.0.1, =2.7.6, =0.2.0, =11.3.0 and more Source cves: CVE-2026-33468 Source advisory: SNYK:JS-KYSELY-15763566...

@mikro-orm/entity-generator (>=7.0.2-dev.17, <=7.0.5-dev.1), @mikro-orm/libsql (>=7.0.2-dev.17, <=7.0.5-dev.1) +11 more potentially affected by CVE-2026-33442 via kysely (>=0.28.12, <=0.28.13)

kysely NPM version =0.28.12, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.5-dev.1 - @omnitron-dev/omnitron 0.1.3 - @omnitron-dev/testing 0.1.3 - @omnitron-dev/titan-database 0.1.3 Source...

OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)

Summary OpenClaw tools.exec.safeBins had a stdin-only policy bypass for grep. If pattern input was supplied through -e / --regexp, the validator consumed the pattern as a flag value and still allowed one positional operand. That positional could be a bare filename like .env. Affected Packages /...

Ghost has a SQL injection in Content API

Impact A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. Vulnerable Versions This vulnerability is present in Ghost v3.24.0 to v6.19.0. Patches v6.19.1 contains a fix for this issue. Note: as this...

@071yoon/log-console-core (0.1.0), @adarshanatia/init-web (>=1.0.0, <=1.0.1) +125 more potentially affected by CVE-2025-55182 +1 more via next (>=16.0.0, <=16.0.6)

next NPM version =16.0.0, =1.0.0, =0.3.128, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.9.58-canary.1, =0.1.0, =1.0.4186, =0.1.0, =1.0.0, =0.1.0, =0.1.2, =0.2.2 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...

@alexbeck2911/componentx (>=0.1.0, <=0.1.5), @amraneze/react-instagram-login (>=2.0.0, <=2.0.1) +296 more potentially affected by CVE-2023-45133 via babel-traverse (>=7.0.0-alpha.1, <=7.0.0-beta.3)

babel-traverse NPM version =7.0.0-alpha.1, =0.1.0, =2.0.0, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =6.0.0-rc1, =0.3.0, =0.19.0, =1.0.0, =1.0.0, =5.0.20, =6.0.6 and more Source cves: CVE-2023-45133 Source advisory: OSV:GHSA-67HX-6X53-JW92...

PT-2019-16977 · Ibm · Ibm Pureapplication System

Name of the Vulnerable Software and Affected Versions: IBM PureApplication System versions 2.2.3.0 through 2.2.5.3 Description: The issue allows a remote attacker to send specially-crafted SQL statements, which could enable the attacker to view, add, modify, or delete information in the back-end...