Linux Distros Unpatched Vulnerability : CVE-2026-60163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are...

Exploit for CVE-2026-14266

CVE-2026-14266 — 7-Zip XZ Decoder Heap Buffer Overflow Cr...

Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git

Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it...

CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Linux Distros Unpatched Vulnerability : CVE-2026-55851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and...

Linux Distros Unpatched Vulnerability : CVE-2026-11605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not...

Linux Distros Unpatched Vulnerability : CVE-2026-60317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Net. Supported versions that are affected are 9.7.0-9.7.1. Difficult to explo...

Linux Distros Unpatched Vulnerability : CVE-2026-56746

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through...

@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +8 more potentially affected by CVE-2026-14257 via brace-expansion (>=2.0.0, <=2.0.2)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-14257 Source advisory: OSV:GHSA-MH99-V99M-4GVG...

@3w5h/knowledge_query (1.0.30), @3w5h/utils (>=1.0.0, <=1.0.7) +649 more potentially affected by unknown CVE via sm-crypto (>=0.0.9, <=0.4.0)

sm-crypto NPM version =0.0.9, =1.0.0, =0.1.0, =1.0.13, =4.4.42, =0.0.2, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.7.8-alpha.2 - @ancademy/bespoke-group-share 2.5.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-SMCRYPTO-18601952...

budibase (>=0.0.3, <=0.0.31) potentially affected by unknown CVE via @budibase/server (>=0.0.1, <=0.0.31)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: unknown CVE Source advisory: SNYK:JS-BUDIBASESERVER-18308463...

@cedarjs/api-server (>=1.0.0-canary.12863, <=9.0.0-canary.1784), @cedarjs/api-server-watch (>=6.0.0-canary.2828, <=6.0.0-canary.2930) +19 more potentially affected by CVE-2026-44907 via react-server-dom-webpack (>=19.2.0-canary-cee7939b-20250625, <=19.2.7)

react-server-dom-webpack NPM version =19.2.0-canary-cee7939b-20250625, =1.0.0-canary.12863, =6.0.0-canary.2828, =1.0.0-canary.12863, =5.0.4-next.167, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =3.0.0-canary.13429, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href

Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...

@20206205tech/nestjs-auth (>=1.0.0, <=1.4.1), @20206205tech/nestjs-common (>=0.3.0, <=0.11.4) +726 more potentially affected by CVE-2026-73643 via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =1.0.0, =0.3.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =1.1.0, =1.1.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =1.5.6 and more Source cves: CVE-2026-73643 Source advisory: OSV:GHSA-PM4M-PH32-GHV5...

@aaravpos/appointment-barber-booking (>=1.0.0, <=4.0.5), @aaravpos/appointment-booking-plugin (>=1.0.1, <=7.0.6) +271 more potentially affected by unknown CVE via react-router (>=7.12.0, <=7.18.1)

react-router NPM version =7.12.0, =1.0.0, =1.0.1, =0.0.9-alpha-20260107202750-16b04dcbaa92c7fc2bbb580dbc1da723c76a5225, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.0, =3.2.0-ultramodern.127 and more Source...

@3kles/3kles-coremongodb (>=1.2.3, <=1.3.1), @3kles/storagebox-common (1.0.3) +419 more potentially affected by unknown CVE via mongoose (>=6.0.1, <=6.13.9)

mongoose NPM version =6.0.1, =1.2.3, =2.0.1, =0.0.1-alpha.89, =0.0.1-alpha.89, =0.0.3, =1.0.5, =3.9.0, =1.0.9, =1.0.0-beta1, =1.4.5, =1.1.80, =0.0.1, =0.1.16 and more Source cves: unknown CVE Source advisory: SNYK:JS-MONGOOSE-18319533...

123ts-backend-setup-prod (1.0.0), 4casterschemas (>=1.0.0, <=1.0.1) +199 more potentially affected by CVE-2026-73562 via mongoose (>=8.0.0, <=8.24.0)

mongoose NPM version =8.0.0, =1.0.0, =2.1.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =3.13.0, =3.17.2 - @albertoielpo/kk-cli 1.0.7 and more Source cves: CVE-2026-73562 Source advisory: OSV:GHSA-664H-WQGQ-64GW...

@openinc/parse-server-opendash (>=4.0.0, <=4.1.1) potentially affected by CVE-2026-66009 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.1 Source cves: CVE-2026-66009 Source advisory: SNYK:JS-PARSESERVER-18306805...

Exploit for Path Traversal in Grafana

CVE-2021-43798: Unauthenticated Directory Traversal in Grafana...

CVE-2026-15663

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...