Linux Distros Unpatched Vulnerability : CVE-2026-39863

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Kamailio is an open source implementation of a SIP Signaling Server. Prior to 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access in the core of Kamailio formerly...

wasmtime 安全漏洞

Wasmtime is a lightweight WebAssembly runtime open source by the Bytecode Alliance. Versions prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1 of Wastime contain security vulnerabilities. These vulnerabilities arise when using the Val type promotion feature to increase values of component models. If bi...

Juniper Networks Junos OS SRX和Juniper Networks Junos OS MX 安全漏洞

Juniper Networks Junos OS SRX and Juniper Networks Junos OS MX are both products of Juniper Networks, a US-based networking company. Juniper Networks Junos OS SRX is a network operating system specifically designed for the company’s hardware devices. This operating system provides secure...

PT-2026-31565

Name of the Vulnerable Software and Affected Versions Agions taskflow-ai versions through 2.1.8 Description A security flaw exists in Agions taskflow-ai up to version 2.1.8. The issue impacts an unknown function within the src/mcp/server/handlers.ts file of the terminal execute component, leading...

wasmtime 缓冲区错误漏洞

Wasmtime is a lightweight WebAssembly runtime open source by the Bytecode Alliance. Versions of Wastime prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1 contained a buffer error vulnerability. This vulnerability stemmed from the lack of validation for the return value of the realloc function in guest...

CVE-2026-4332

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due...

CVE-2025-9484 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user to have access to other users' email addresses via certain GraphQL queries...

CVE-2026-4332 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that, in customizable analytics dashboards, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browsers due...

CVE-2026-3199 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection

A vulnerability in the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2 allows an authenticated attacker with task creation permissions to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control...

@frontmcp/adapters (>=1.0.0-beta.1, <=1.0.3), @frontmcp/plugin-approval (>=1.0.0-beta.1, <=1.0.3) +7 more potentially affected by CVE-2026-39885 via @frontmcp/sdk (>=1.0.0, <=1.0.3)

@frontmcp/sdk NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =0.0.1, =1.0.0-beta.1, =1.0.0-beta.1, =0.0.1, =1.0.3 Source cves: CVE-2026-39885 Source advisory: SNYK:JS-FRONTMCPSDK-16423474...

@b4uti4gd/tslash (>=1.0.0, <=1.0.1), @bitsnbobs/starch (>=1.4.0, <=2.1.0) +95 more potentially affected by unknown CVE via @chenglou/pretext (>=0.0.1, <=0.0.4)

@chenglou/pretext NPM version =0.0.1, =1.0.0, =1.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-CHENGLOUPRETEXT-16321421...

@b4uti4gd/tslash (>=1.0.0, <=1.0.1), @bitsnbobs/starch (>=1.4.0, <=2.1.0) +95 more potentially affected by unknown CVE via @chenglou/pretext (>=0.0.1, <=0.0.4)

@chenglou/pretext NPM version =0.0.1, =1.0.0, =1.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5478-66C3-RHXR...

EUVD-2026-20548

An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files when a malicious configuration file is processed. Successful exploitation may allow unauthorized access to arbitrary files on the device,...

CVE-2026-5898

Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +659 more potentially affected by CVE-2026-23869 via next (>=15.6.0-canary.41, <=16.2.2)

next NPM version =15.6.0-canary.41, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-23869 Source...

Arbitrary Command Injection

Overview @idachev/mcp-javadc is a Model Context Protocol MCP server for Java decompilation Affected versions of this package are vulnerable to Arbitrary Command Injection via the HTTP Interface component when processing the jarFilePath argument. An attacker can execute arbitrary operating system...

CVE-2026-5436 MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys

The MW WP Form plugin for WordPress is vulnerable to Arbitrary File Move/Read in all versions up to and including 5.1.1. This is due to insufficient validation of the $name parameter upload field key passed to the generateuserfiledirpath function, which uses WordPress's pathjoin — a function that...

CVE-2026-35476

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any us...

@activeboxes/piece-sftp (0.2.6), @activepieces/piece-sftp (>=0.2.6, <=0.4.6) +23 more potentially affected by CVE-2026-39983 via basic-ftp (>=5.0.2, <=5.1.0)

basic-ftp NPM version =5.0.2, =0.2.6, =1.0.0, =1.0.0, =2.0.18, =1.9.2, =1.2.0, =4.6.0-blowfish, =1.0.3, =1.0.4, =0.1.1, =0.1.0, =0.1.1 and more Source cves: CVE-2026-39983 Source advisory: SNYK:JS-BASICFTP-15953339...

CVE-2026-34782

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/aiassistance/texttools/:id was not checking if a user is privileged to use the text tool, resulting in being able to use it in all situations. This vulnerability is fixed i...