4m-node-server (>=0.0.1, <=0.0.8), @2109-t5/server (>=1.0.0, <=1.0.9) +987 more potentially affected by CVE-2026-23897 via apollo-server (>=0.1.5, <=3.13.0)

apollo-server NPM version =0.1.5, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.1, =0.0.1, =1.0.7, =0.4.0-alpha.0, =10.4.0, =9.0.0, =10.0.0, =11.2.0 and more Source cves: CVE-2026-23897 Source advisory: SNYK:JS-APOLLOSERVER-15208674...

EUVD-2026-5378

ESF-IDF is the Espressif Internet of Things IOT Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, an out-of-bounds read vulnerability was reported in the BLE ATT Prepare Write handling of the BLE provisioning transport protocommble. The issue can be triggered by a remote B...

CVE-2026-25532

CVE-2026-25532 affects Espressif ESP-IDF WPS Enrollee in versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6. A malformed EAP-WSC packet with truncated payload can trigger an integer underflow during fragment length calculation, when processing EAP-Expanded (WSC) messages. The frag_len calculation sub...

@regis-samurai/n8n (>=0.216.1, <=0.219.1), n8n-nodes-accelo (>=0.1.0, <=0.1.9) +5 more potentially affected by CVE-2026-21893 via n8n (>=0.199.0, <=0.219.1)

n8n NPM version =0.199.0, =0.216.1, =0.1.0, =0.18.0, =0.1.0, =0.1.0, =0.1.7 Source cves: CVE-2026-21893 Source advisory: OSV:GHSA-7C4H-VH2M-743M...

CVE-2026-25139 RIOT Vulnerable to Multiple Out-of-Bounds Read When Processing Received 6LoWPAN SFR Fragments

RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things IoT devices and other embedded devices. In version 2025.10 and prior, multiple out-of-bounds read allow any unauthenticated user, with ability to send or manipulate input packets, to...

CVE-2025-69213

OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists in the ajaxcomplete.php endpoint when handling the getsedi operation. An authenticated attacker can inject malicious SQL code through the...

CVE-2026-22247

CVE-2026-22247 affects GLPI (versions 11.0.0 through

CVE-2025-15368

Vulnerability summary (CVE-2025-15368) : The SportsPress WordPress plugin (versions up to 2.7.26) is vulnerable to Local File Inclusion via the shortcodes’ template_name attribute. Authenticated attackers with contributor-level permissions or higher can include and execute arbitrary server files,...

WordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability

Settings Change vulnerability discovered by Legion Hunter in WordPress Plugin Addonify – WooCommerce Wishlist versions = 2.0.15...

CVE-2026-0816

The CVE-2026-0816 entry concerns the WordPress plugin “All push notification for WP” (versions

EUVD-2026-5406

The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

multi-clasp2 (4.0.0) potentially affected by CVE-2026-4092 via @google/clasp (3.1.3)

@google/clasp NPM version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @google/clasp and may be impacted: - multi-clasp2 4.0.0 Source cves: CVE-2026-4092 Source advisory: SNYK:JS-GOOGLECLASP-15248426...

Exploit for CVE-2026-0828

💀 0xKern3lCrush-M4te-CVE-2026-0828 Windows BYOVD Research &...

WordPress plugin SportsPress 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Group Office 操作系统命令注入漏洞

Group Office is a modular office suite developed by the Dutch company Group Office. Versions of Group Office prior to 6.8.150, 25.0.82, and 26.0.5 contained an operating system command injection vulnerability. This vulnerability stemmed from improper parameter concatenation in the...

GLPI 代码问题漏洞

GLPI is an open-source IT and asset management software developed by GLPI. This software provides a comprehensive IT resource management interface, allowing you to create databases to manage various IT assets such as computers, monitors, servers, printers, network devices, telephones, and even...

PT-2026-5886

Name of the Vulnerable Software and Affected Versions SportsPress plugin for WordPress versions through 2.7.26 Description The SportsPress plugin for WordPress is susceptible to Local File Inclusion via the 'template name' attribute within shortcodes. This allows authenticated attackers with...

Locutus 安全漏洞

Locutus is an open-source JavaScript library developed by Locutus. Versions of Locutus from 2.0.12 to 2.0.39 contained security vulnerabilities. These vulnerabilities were due to insufficient input validation, which could lead to prototype pollution...

PT-2026-6262

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.10 n8n versions prior to 2.5.0 Description n8n, an open source workflow automation platform, contains a flaw in the Git node. This allows authenticated users with create or modify permissions for workflows to execut...

PT-2026-6271

Name of the Vulnerable Software and Affected Versions melange versions 0.10.0 through 0.40.2 Description melange enables users to construct APK packages utilizing declarative pipelines. A flaw exists in versions 0.10.0 up to, but not including, 0.40.3 where an attacker capable of manipulating...