@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +4 more potentially affected by CVE-2026-35413 via directus (>=11.0.0, <=11.16.0)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =34.0.0 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-35413 Source advisory: SNYK:JS-DIRECTUS-15907597...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +5 more potentially affected by CVE-2026-39942 via directus (>=11.0.0, <=11.16.1)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =34.0.1 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-39942 Source advisory: OSV:GHSA-393C-P46R-7C95...

@budibase/backend-core (>=3.0.0, <=3.2.26), @budibase/bbui (>=3.0.0, <=3.2.26) +7 more potentially affected by CVE-2026-35216 via @budibase/types (>=3.0.0, <=3.2.26)

@budibase/types NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-35216 Source advisory: SNYK:JS-BUDIBASETYPES-15917498...

Improper Authorization in Handler for Custom URL Scheme

Overview @mobilenext/mobile-mcp is a Mobile MCP Affected versions of this package are vulnerable to Improper Authorization in Handler for Custom URL Scheme via the mobileopenurl function. An attacker can execute arbitrary Android intents, such as initiating phone calls, sending SMS messages,...

CVE-2026-2924

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageLoad' parameter in versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-2924

CVE-2026-2924 affects the Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting flaw via the imageLoad parameter in versions up to and including 3.4.6, caused by insufficient input sanitization and output escaping. A...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the GET /api/v1/main/flows/search endpoint. An attacker can execute arbitrary operating system commands by injecting malicious SQL payloads that leverage PostgreSQL's COPY ... TO PROGRAM ... functionality after...

CVE-2026-35616

Fortinet FortiClient EMS is vulnerable to CVE-2026-35616 in versions 7.4.5 and 7.4.6. The issue is an improper access control where Django middleware also trusts HTTP headers (X-SSL-CLIENT-VERIFY, X-SSL-CLIENT-S-DN, X-SSL-CLIENT-SERIAL) for certificate-derived authentication, enabling an unauthen...

Tenda 4G03 Pro 访问控制错误漏洞

The Tenda 4G03 Pro is a wireless router produced by the Chinese company Tenda. The versions 1.0, 1.1, 04.03.01.53, and 192.168.0.1 of the Tenda 4G03 Pro have vulnerabilities related to access control. These vulnerabilities stem from improper access control in the /bin/httpd file...

PT-2026-30304

Name of the Vulnerable Software and Affected Versions Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress versions up to and including 3.4.6 Description The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is susceptible to Stored...

PT-2026-30311

The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su carousel shortcode in all versions up to, and including, 7.4.8. This is due to insufficient input sanitization and output escaping in the 'su slide link' attachment meta...

Electron 操作系统命令注入漏洞

Electron is an open-source JavaScript framework developed by users for creating cross-platform desktop applications. This framework is based on Node.js and Chromium, allowing the development of cross-platform desktop applications using HTML and CSS. Versions of Electron prior to 38.8.6, 39.8.1,...

Linux Distros Unpatched Vulnerability : CVE-2024-14031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sereal::Encoder versions from 4.000 through 4.009002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Encoder embeds a version of the...

PT-2026-30305

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress WCFM - WooCommerce Frontend Manager plugin <= 6.7.25 - Insecure Direct Object References to Authenticated (Vendor+) Arbitrary Post/Product Manipulation vulnerability

WordPress WCFM - WooCommerce Frontend Manager plugin = 6.7.25 - Insecure Direct Object References to Authenticated Vendor+ Arbitrary Post/Product Manipulation vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin WCFM – Frontend Manager for...

CVE-2026-34715

ewe is a Gleam web server. Prior to version 3.0.6, the encodeheaders function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF \r\n sequences. An application that passes user-controlled data into...

CVE-2026-34931

hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0...

OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals

Description Six confrontarighe.php files across different modules in OpenSTAManager fetchArray 'SELECT mgarticolilang.title, mgarticoli.codice, inrigheinterventi. FROM inrigheinterventi INNER JOIN...

@budibase/backend-core (>=3.0.0, <=3.2.26), @budibase/bbui (>=3.0.0, <=3.2.26) +6 more potentially affected by CVE-2026-25044 via @budibase/shared-core (>=3.0.0, <=3.2.26)

@budibase/shared-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-25044 Source advisory: SNYK:JS-BUDIBASESHAREDCORE-15917501...

@budibase/backend-core (>=3.0.0, <=3.2.26), @budibase/bbui (>=3.0.0, <=3.2.26) +7 more potentially affected by CVE-2026-25044 via @budibase/types (>=3.0.0, <=3.2.26)

@budibase/types NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-25044 Source advisory: SNYK:JS-BUDIBASETYPES-15917502...