@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48068 Source advisory: OSV:GHSA-5375-PQ7M-F5R2...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +5324 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.0.0, <=1.9.14)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.0.0, =0.3.30, =0.3.30, =0.4.16 and more Source cves: CVE-2026-48068 Source advisory: SNYK:JS-GRPCGRPCJS-17315646...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +132 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.14.0, <=1.14.3)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.2.2, =0.10.0, =0.56.0 - @bnonni/terminal 0.1.0 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@alenon/grpc-mock-server (>=3.1.21, <=3.2.3), @aliceo2/bookkeeping (>=1.8.0, <=1.12.0) +129 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.13.0, <=1.13.4)

@grpc/grpc-js NPM version =1.13.0, =3.1.21, =1.8.0, =1.76.0, =1.0.0, =2.0.1, =1.0.7, =2.0.0, =1.1.37, =12.3.0, =0.3.1, =0.3.1, =0.3.8 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +132 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.14.0, <=1.14.3)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.2.2, =0.10.0, =0.56.0 - @bnonni/terminal 0.1.0 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1784 more potentially affected by CVE-2026-48038 via joi (>=17.1.1, <=17.13.3)

joi NPM version =17.1.1, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.1.12, =1.7.1, =1.8.31, =1.0.0, =1.16.34-beta-20241113-102431-65542b84 and more Source cves: CVE-2026-48038 Source advisory: SNYK:JS-JOI-17317897...

GHSA-V446-XWFM-X7MR vulnerabilities

Vulnerabilities for packages: libcrypto3-2.34, openssl...

Exploit for CVE-2026-48907

CVE-2026-48907 Educational PoC ⚠️ This repository is for ed...

The Hidden Security Risks of Poor Software Testing

Poor Software Testing can expose hidden flaws, vulnerable dependencies and weak controls, increasing breach risks, downtime and costly fixes after release...

CVE-2026-48998 guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP request messages and when deriving a server request URI from server variables. An attacker can provide a malformed Host header containing U...

abd-clam (>=0.21.8, <=0.25.3), abe_gpsw (>=0.8.0, <=2.0.0) +636 more potentially affected by unknown CVE via pyo3 (>=0.2.7, <=0.28.3)

pyo3 CARGO version =0.2.7, =0.21.8, =0.8.0, =0.12.0, =0.2.1, =0.3.0, =0.1.0, =0.1.2, =2.0.0-rc.1, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.14 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0177...

arrow-pyarrow (>=55.2.0, <=59.0.0), ct-python (>=0.5.9, <=0.5.12) +3 more potentially affected by unknown CVE via pyo3 (>=0.24.2, <=0.28.3)

pyo3 CARGO version =0.24.2, =55.2.0, =0.5.9, =0.14.0, =0.14.0, =0.4.0, =0.8.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0176...

CVE-2026-6269 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to modify hidden merge requests due to incorrect...

CVE-2026-5497

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory OOM Denial of Service DoS attack due to unbounded frame count processing in the VideoMediaIO.loadbase64 method. When processing video/jpeg data URLs, the method splits the base64 data string on commas to extract individual JPEG fram...

CVE-2026-45505

A flaw was found in Apache ActiveMQ. This vulnerability allows an authenticated attacker to bypass a previous fix for CVE-2026-34197 by using non-parenthesized discovery wrappers. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the RemotingHandler function. An attacker can execute arbitrary scripts in the user's browser by crafting error responses that include attacker-controlled input, which are then rendered as HTML. Details...

CVE-2026-41700

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials...

GHSA-9GGW-87M9-9GFC Spring Web Flow has Data Binding Vulnerability with Unified EL Parser

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1...