@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +217 more potentially affected by CVE-2026-86251 via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: CVE-2026-86251 Source advisory: OSV:GHSA-72GR-QFP7-VWHW...

@abiswas97/postgres-mcp (2.0.0), @ampt/sql (1.0.1) +748 more potentially affected by CVE-2026-33468 via kysely (>=0.3.9, <=0.28.13)

kysely NPM version =0.3.9, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =0.0.1, =0.0.0, =0.1.0, =0.0.2, =0.0.1, =2.7.6, =0.2.0, =11.3.0 and more Source cves: CVE-2026-33468 Source advisory: SNYK:JS-KYSELY-15763566...

@mikro-orm/entity-generator (>=7.0.2-dev.17, <=7.0.5-dev.1), @mikro-orm/libsql (>=7.0.2-dev.17, <=7.0.5-dev.1) +11 more potentially affected by CVE-2026-33442 via kysely (>=0.28.12, <=0.28.13)

kysely NPM version =0.28.12, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.2-dev.17, =7.0.5-dev.1 - @omnitron-dev/omnitron 0.1.3 - @omnitron-dev/testing 0.1.3 - @omnitron-dev/titan-database 0.1.3 Source...

WordPress Feedy theme < 2.1.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Phat RiO in WordPress Theme Feedy versions 2.1.5...

CVE-2026-33156 DLL Sideloading in ScreenToGif

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32...

CVE-2026-33150

CVE-2026-33150 affects libfuse: the io_uring subsystem vulnerability exists from 3.18.0 up to just before 3.18.2. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool but stores a dangling pointer in the session state, caus...

CVE-2026-33139 PySpector: Plugin Sandbox Bypass leads to Arbitrary Code Execution

PySpector is a static analysis security testing SAST Framework engineered for modern Python development workflows. PySpector versions 0.1.6 and prior are affected by a security validation bypass in the plugin system. The validateplugincode function in pluginsystem.py, performs static AST analysis...

Exploit for Missing Authorization in Scshr Hr_Portal

CVE-2025-48734: Apache Commons BeanUtils – enum declaredClass...

@amqp-contract/asyncapi (>=0.2.0, <=0.20.0), @c15t/backend (>=1.1.0-canary.0, <=1.8.5) +13 more potentially affected by CVE-2026-33331 via @orpc/openapi (>=1.0.0-beta.1, <=1.13.8)

@orpc/openapi NPM version =1.0.0-beta.1, =0.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.0, =0.4.2, =1.0.0-beta.2, =0.0.0, =0.0.0, =1.0.0-beta.2, =1.0.0-beta.1, =1.2.0-canary.0, =1.8.5 Source cves: CVE-2026-33331 Sour...

WordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms versions = 1.1.5...

WordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin SMTP Mailer versions = 1.1.24...

graph-generator-lib (>=0.1.0, <=0.1.10), libunftp (>=0.6.0, <=0.6.1) +7 more potentially affected by unknown CVE via tokio-compat (0.1.6)

tokio-compat CARGO version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on tokio-compat and may be impacted: - graph-generator-lib =0.1.0, =0.6.0, =0.1.0, =0.1.3 - parity-runtime 0.1.2 - price-info 1.12.0 - rudolfs 0.2.11 - sccache 0.2.15 -...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.6.2) +1843 more potentially affected by unknown CVE via tokio-uds (>=0.1.5, <=0.3.0-alpha.1)

tokio-uds CARGO version =0.1.5, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0 - actix-multipart-rfc7578 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0050...

abci-rs (0.10.0), abuseipdb (>=0.1.0, <=0.2.1) +1841 more potentially affected by unknown CVE via tokio-tls (>=0.2.1, <=0.3.1)

tokio-tls CARGO version =0.2.1, =0.1.0, =0.1.0, =0.7.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.4.0, =1.0.0-alpha.3, =0.7.4, =0.7.19 - actori-tls 1.0.0 - actyxosdataflow 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0053...

a2 (>=0.2.0, <=0.4.1), abci (>=0.5.3, <=0.7.1) +2899 more potentially affected by unknown CVE via tokio-threadpool (>=0.1.14, <=0.2.0-alpha.1)

tokio-threadpool CARGO version =0.1.14, =0.2.0, =0.5.3, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.8.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0051...

BIT-PARSE-2026-32878 Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.44, an attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields by sending a crafted request that exploits...

CVE-2026-32595

Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that allows username enumeration via a timing attack. When a submitted username exists, the middleware performs a bcrypt password comparison taki...

CVE-2026-32305

Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records,...

CVE-2026-33135 WeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameter

WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting XSS vulnerability in the novomemorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without...

CVE-2026-33133 WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator...