CVE-2026-25059

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated with validated directories using stdpath.Join. Thi...

CVE-2025-6596

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vecto...

CVE-2025-6596

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vecto...

@activepieces/piece-snowflake (>=0.2.1, <=0.3.0), @bhanu17/nextjs-starter (>=1.2.0, <=2.2.14) +99 more potentially affected by CVE-2026-3449 via @tootallnate/once (2.0.0)

@tootallnate/once NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @tootallnate/once and may be impacted: - @activepieces/piece-snowflake =0.2.1, =1.2.0, =0.0.18, =0.2.0, =0.0.6, =0.0.1, =0.6.0, =0.1.1-preview.36484880702, =0.4.2,...

CVE-2026-23515 RCE - Command Injection in Signal K set-system-time plugin

Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated...

Missing Validation of OpenSSL Certificate

Overview Affected versions of this package are vulnerable to Missing Validation of OpenSSL Certificate due to the default configuration of DefaultConfig where TLS certificate verification is disabled for outgoing storage driver communications. An attacker can intercept, decrypt, and manipulate al...

WordPress Elementor Addon Elements plugin <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Elementor Addon Elements versions = 1.13.2...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +4 more potentially affected by CVE-2026-24737 via jspdf (4.0.0)

jspdf NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jspdf and may be impacted: - @firedesktop/react-portal-base 2.1.2 - @imaginario27/air-ui-utils =1.0.8, =1.4.0-I18n-QM, =0.5.129, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves:...

GHSA-PQXR-3G65-P328 jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution

Impact User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +4 more potentially affected by CVE-2026-24133 via jspdf (4.0.0)

jspdf NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jspdf and may be impacted: - @firedesktop/react-portal-base 2.1.2 - @imaginario27/air-ui-utils =1.0.8, =1.4.0-I18n-QM, =0.5.129, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves:...

CVE-2026-22223

Technical details about CVE-2026-22223 are not provided in the supplied documents. Public specifics (vendors, affected versions, impact) are not disclosed here. Monitor for updates from vendors and security advisories.

WordPress WP To Do plugin <= 1.3.0 - Cross-Site Request Forgery via wptodo_settings vulnerability

Cross-Site Request Forgery via wptodosettings vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin WP To Do versions = 1.3.0...

WordPress Tutor LMS Elementor Addons plugin <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Course Carousel Widget vulnerability discovered by wesley wcraft in WordPress Plugin Tutor LMS Elementor Addons versions = 2.1.4...

CVE-2026-22881

CVE-2026-22881 affects Cybozu Garoon 5.15.0 through 6.0.3, where a cross-site scripting vulnerability in the Message function could allow an attacker to reset arbitrary users’ passwords. Root cause is not explicitly detailed beyond the XSS in the Message feature. No exploitation status or in-the-...

CVE-2025-15396 Library Viewer < 3.2.0 - Reflected Cross-Site Scripting

The Library Viewer WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.

Summary The IBM Maximo Application Suite AI-Service component uses"fonttools-4.44.3-cp311-cp311-manylinux217x8664.manylinux2014x8664.whl, fonttools-4.55.3-cp311-cp311-manylinux217x8664.manylinux2014x8664.whl, werkzeug-3.0.6-py3-none-any.whl, filelock-3.13.4-py3-none-any.whl,...

Group Office 参数注入漏洞

Group Office is a modular office suite developed by the Dutch company Group Office. Versions of Group Office prior to 6.8.150, 25.0.82, and 26.0.5 contained a parameter injection vulnerability. This vulnerability stemmed from the direct passing of the lang parameter to system commands, which coul...

📄 Serendipity 1.6.2 Cross Site Scripting

Multiple cross site scripting vulnerabilities exist in Serendipity version 1.6.2. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This issue is older research added to the archive. Serendipity 1.6.2 - Cross-site Scripting Advisory ID: RO-13-002 Severity: Mediu...

Huawei EulerOS: Security Advisory for unbound (EulerOS-SA-2026-1201)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2026-1164)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...