@cwa/nuxt-edge (>=1.0.0-29304822.f444f03, <=1.0.0-29317775.3ebbdc9), @geode/opengeodeweb-front (>=9.13.1-rc.9, <=10.0.2-rc.4) +1 more potentially affected by CVE-2026-56301 via nuxt (>=3.18.1, <=3.20.1)

nuxt NPM version =3.18.1, =1.0.0-29304822.f444f03, =9.13.1-rc.9, =1.0.1-alpha.0, =1.0.1-alpha.33 Source cves: CVE-2026-56301 Source advisory: SNYK:JS-NUXT-17353897...

@cwa/nuxt-edge (>=1.0.0-29304822.f444f03, <=1.0.0-29317775.3ebbdc9), @geode/opengeodeweb-front (>=9.13.1-rc.9, <=10.0.2-rc.4) +1 more potentially affected by CVE-2026-56301 via nuxt (>=3.18.1, <=3.20.1)

nuxt NPM version =3.18.1, =1.0.0-29304822.f444f03, =9.13.1-rc.9, =1.0.1-alpha.0, =1.0.1-alpha.33 Source cves: CVE-2026-56301 Source advisory: OSV:GHSA-534H-C3CW-V3H9...

EUVD-2026-36427

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +31 more potentially affected by CVE-2026-53721 via nuxt (>=3.11.2, <=3.20.1)

nuxt NPM version =3.11.2, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.2.1, =1.2.0, =1.1.0, =1.0.0-29304822.f444f03, =8.0.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.0.1-alpha.0, =1.0.0, =1.43.0 and more Source cves: CVE-2026-53721 Source advisory: OSV:GHSA-MM7M-92G8-7M47...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +20 more potentially affected by CVE-2026-56326 via nuxt (>=4.0.0-rc.0, <=4.4.6)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =1.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-56326 Source advisory: SNYK:JS-NUXT-17353894...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +88 more potentially affected by CVE-2026-56326 via nuxt (>=3.0.0, <=3.20.1)

nuxt NPM version =3.0.0, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-56326 Source advisory: SNYK:JS-NUXT-17353894...

WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin JobSearch versions = 3.2.9...

CVE-2026-8484

A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes DoS. All versions are believed to be vulnerable. This project is unmaintained at...

BIT-MYSQL-CLIENT-2026-44173 MariaDB: FILE privilege was not checked for subqueries in the FROM clause

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privileg...

CVE-2026-8484

The CVE-2026-8484 entry describes a heap buffer overflow in the Jansi JNI"ioctl()" wrapper caused by missing size verification of the argument array before the system call. Affected software is Jansi (JNI wrapper) and, per sources, all versions are believed vulnerable. Consequences stated are hea...

EUVD-2026-37064

A heap buffer overflow vulnerability exists in the Jansi JNI "ioctl" wrapper due to a lack of size verification for the argument array before the system call. This can lead to heap corruption and application crashes DoS. All versions are believed to be vulnerable. This project is unmaintained at...

CVE-2026-40809 WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1...

CVE-2026-52714 WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.16 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO = 12.4.16 versions...

mysql: Optimizer unspecified vulnerability (CPU Apr 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network...

CVE-2026-8444 WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs' parameter of the wpfbfindreviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $POST'curselrevs' raw with no sanitization or type casting, then concatenatin...

PT-2026-50098

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking = 2.1.2 versions...

PT-2026-49882

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware WebLogic Server versions 12.2.1.4.0 Oracle Fusion Middleware WebLogic Server versions 14.1.2.0.0 Description An issue in the Core component allows a low privileged attacker with network access via HTTP to compromise th...

PT-2026-49868

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

PT-2026-49943

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: End User Self Service. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Identity...

📄 Wertheim SafeController Software for VAULT ROOMS Traversal / Bypass / Broken Controls

Wertheim SafeController Software for VAULT ROOMS with AssemblyVersion 6.15.8328.28014 suffer from violation of least privilege, broken websocket authorization, broken access control, IP restriction bypass, path traversal, upload restriction bypass, unauthenticated access, hardcoded secret,...