@ablehi/automation-app-build (>=0.1.0, <=0.3.6), @ablehi/automation-app-cli (>=0.1.0, <=0.3.5) +144 more potentially affected by CVE-2026-39365 via vite (>=8.0.0, <=8.0.3)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =3.0.1-alpha.0, =3.3.0, =11.17.0-depup.0, =35.0.0, =17.1.0, =4.0.0, =9.6.10, =0.1.0, =0.1.0, =0.0.0-experimental-04f2240-20260306-7fcde375, =0.0.0-experimental-fd6d426-20260301-87c73ec5 and more Source cves: CVE-2026-39365 Source advisory:...

@slidev-react/cli (>=0.4.6, <=0.4.14), @slidev-react/node (>=0.4.6, <=0.4.14) potentially affected by CVE-2026-39364 via vite-plus (0.1.11)

vite-plus NPM version 0.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on vite-plus and may be impacted: - @slidev-react/cli =0.4.6, =0.4.6, =0.4.14 Source cves: CVE-2026-39364 Source advisory: SNYK:JS-VITEPLUS-15922246...

@142vip/nest (>=0.0.1-alpha.2, <=0.0.1-alpha.10), @142vip/nest-starter (>=0.0.1-alpha.9, <=0.0.1-alpha.14) +88 more potentially affected by CVE-2026-35515 via @nestjs/core (>=11.0.0, <=11.1.17)

@nestjs/core NPM version =11.0.0, =0.0.1-alpha.2, =0.0.1-alpha.9, =0.0.1, =13.3.0-rc.7, =1.1.3, =6.0.0-alpha.1, =3.8.8, =1.114.0, =3.8.8, =1.0.3-alpha.0b30e6d.0, =20250227.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2026-35515 Source advisory: SNYK:JS-NESTJSCORE-15920868...

CVE-2026-35171 Arbitrary Code Execution via Malicious Logging Configuration in Kedro

Kedro is a toolbox for production-ready data science. Prior to 1.3.0, Kedro allows the logging configuration file path to be set via the KEDROLOGGINGCONFIG environment variable and loads it without validation. The logging configuration schema supports the special key, which enables arbitrary...

Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-27628 DESCRIPTION: pypdf i...

CVE-2026-34824

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession o...

CVE-2026-34379 OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a misaligned memory write vulnerability exists in LossyDctDecoderexecute in...

CVE-2026-29047

GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the logs export feature. This vulnerability is fixed in 10.0.24 and 11.0.6...

CVE-2026-26026 GLPI has a Server-Side Template Injection via Double-Compilation

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6...

Exploit for CVE-2026-35678

Vulnerability Research Report: All Eduplus ERP Insecure Direct...

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver BYOVD technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro. Qilin attacks analyzed by Talos have...

EUVD-2026-19130

A flaw has been found in griptape-ai griptape 0.19.4. This affects an unknown part of the file griptape\tools\computer\tool.py of the component ComputerTool. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch the attack remotely. The exploit has...

PT-2026-30613

Name of the Vulnerable Software and Affected Versions Bynder version 0.1.394 Description A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML through a crafted payload. Stored XSS occurs when a malicious script is permanently stored on the target serve...

SandboxJS 安全漏洞

SandboxJS is a security assessment tool developed by nyariv. Versions of SandboxJS prior to 0.8.36 contained security vulnerabilities; these vulnerabilities stemmed from the ability to bypass global object protection through constructor paths, potentially allowing modification of host global obje...

Directus 信息泄露漏洞

Directus is an open-source real-time API and application dashboard developed by Directus. It is used to manage SQL database content. Versions of Directus prior to 11.16.1 contained a vulnerability related to information leakage. This vulnerability stemmed from the serverspecs GraphQL parser not...

KubeAI 操作系统命令注入漏洞

KubeAI is an open-source AI inference platform for deploying and scaling machine learning models on Kubernetes. Versions of KubeAI prior to 0.23.2 contained a vulnerability related to operating system command injection. This vulnerability stemmed from the use of uncleaned model URL components by...

OFFIS DCMTK 操作系统命令注入漏洞

OFFIS DCMTK is a collection of libraries and applications developed by the German company OFFIS that implement most DICOM standards. It includes software for checking, processing, and converting DICOM image files, handling offline media, sending and receiving images via network connections, as we...

datrie 代码问题漏洞

Datrie is an open-source Python library that implements a high-performance dictionary tree. Versions of Datrie prior to 0.8.3 have code vulnerabilities. These vulnerabilities stem from incorrect operations on the functions Trie.load, Trie.read, and Trie.setstate found in the file src/datrie.pyx,...

CVE-2026-5604

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formCertLocalPrecreate of the file /goform/CertLocalPrecreate of the component Parameter Handler. Performing a manipulation of the argument standard results in stack-based buffer overflow. Remote...

EUVD-2019-20081

UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute...