PT-2026-42212

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.2.2 Splunk Enterprise versions prior to 10.0.5 Splunk Cloud Platform versions prior to 10.3.2512.8 Splunk Cloud Platform versions prior to 10.2.2510.11 Splunk Cloud Platform versions prior to 10.1.2507.21...

PT-2026-42066

Name of the Vulnerable Software and Affected Versions Anomify AI – Anomaly Detection and Alerting plugin for WordPress versions prior to 0.3.7 Description The plugin is subject to Stored Cross-Site Scripting, a condition where malicious scripts are permanently stored on the target server. The iss...

CVE-2026-8491

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1...

EUVD-2026-30987

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting XSS vulnerability in the ticket reply notification system. Unsanitized reply content $newmessage is stored directly in database notification payloads and later rendered...

CVE-2026-34241 CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting XSS vulnerability in the ticket reply notification system. Unsanitized reply content $newmessage is stored directly in database notification payloads and later rendered...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-47670 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8-alpha.7)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-47670 Source advisory: SNYK:JS-DBGATEAPI-17223765...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-46417 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-46417 Source advisory: OSV:GHSA-RFH7-FXQC-Q52V...

CVE-2025-57798 Joplin has Denial of Service (DoS) via Uncontrolled Resource Allocation through Title Input

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain a Denial of Service DoS vulnerability in the title input functionality due to a lack of proper length validation. This flaw allows an attacker to cause an Ou...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +20 more potentially affected by CVE-2026-46342 via nuxt (>=4.0.0-rc.0, <=4.4.4)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =1.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-46342 Source advisory: OSV:GHSA-G8WJ-3CR3-6W7V...

NPM: Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

NPM: Nuxt: nuxtisland endpoint does not bind responses to request props, enabling shared-cache poisoning vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, = 3.21.5...

@geode/opengeodeweb-front (>=9.13.1-rc.9, <=10.0.2-rc.4), nuxt (>=3.20.0, <=3.21.5) potentially affected by CVE-2026-46342 via @nuxt/nitro-server (>=3.20.0, <=3.21.5)

@nuxt/nitro-server NPM version =3.20.0, =9.13.1-rc.9, =3.20.0, =3.21.5 Source cves: CVE-2026-46342 Source advisory: SNYK:JS-NUXTNITROSERVER-16770417...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +20 more potentially affected by CVE-2026-46342 via nuxt (>=4.0.0-rc.0, <=4.4.4)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =1.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-46342 Source advisory: SNYK:JS-NUXT-16770418...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +16 more potentially affected by CVE-2026-46342 via @nuxt/nitro-server (>=4.2.0, <=4.4.5)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =0.4.5, =3.0.0-dev.27, =4.2.0, =0.5.0, =1.0.1, =0.4.0, =0.1.13, =0.2.2 and more Source cves: CVE-2026-46342 Source advisory: SNYK:JS-NUXTNITROSERVER-16770417...

clvmr (0.2.5), era-compiler-downloader (1.5.0) +4 more potentially affected by CVE-2026-45784 via openssl (>=0.10.52, <=0.10.68)

openssl CARGO version =0.10.52, =0.19.4, =0.23.3 Source cves: CVE-2026-45784 Source advisory: OSV:GHSA-PHQJ-4MHP-Q6MQ...

@142vip/fairy-cli (>=0.0.3-alpha.19, <=0.0.3-alpha.28), @better-builds/turbo-tools (>=6.0.0, <=7.4.4) +10 more potentially affected by CVE-2026-45773 via turbo (>=2.0.1, <=2.9.12)

turbo NPM version =2.0.1, =0.0.3-alpha.19, =6.0.0, =1.0.0, =0.0.234, =0.3.0, =1.5.1, =0.0.0, =0.3.2, =0.5.0, =1.1.0, =1.4.1 - kbc-cinema-custom-app 1.0.0 Source cves: CVE-2026-45773 Source advisory: OSV:GHSA-HCF7-66RW-9F5R...

EUVD-2026-30551

Turbo: Unexpected local code execution during Yarn Berry detection...

@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @142vip/fairy-cli (>=0.0.3-alpha.19, <=0.0.3-alpha.28) +64 more potentially affected by CVE-2026-45772 via turbo (>=1.3.1, <=2.9.12)

turbo NPM version =1.3.1, =4.2.1, =0.0.3-alpha.19, =1.0.0, =1.6.0, =0.3.0, =0.0.1, =0.1.0, =2.0.5, =0.1.0, =0.1.0, =0.4.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-45772 Source advisory: OSV:GHSA-3QCW-2RHX-2726...

armature-diesel (0.1.0), aruna_policy (>=0.1.0, <=0.1.2) +112 more potentially affected by unknown CVE via diesel (>=2.0.0, <=2.3.4)

diesel CARGO version =2.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.1.0, =0.0.6, =0.1.1, =0.1.5, =0.1.0, =0.1.2, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q8X8-JRHJ-FH9P...

CVE-2026-8073

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for...

apify-agent-mcp (>=0.1.0, <=0.2.0), codify-mcp (>=0.2.0, <=1.0.0) potentially affected by CVE-2026-46341 via @apify/actors-mcp-server (0.7.4)

@apify/actors-mcp-server NPM version 0.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apify/actors-mcp-server and may be impacted: - apify-agent-mcp =0.1.0, =0.2.0, =1.0.0 Source cves: CVE-2026-46341 Source advisory:...