CVE-2026-40347

Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted multipart/form-data requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary...

WordPress plugin Contextual Related Posts 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

ruby: dlopen could open a library with tainted library name

DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names...

ruby: REXML incomplete fix for CVE-2014-8080

The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service CPU and memory consumption a crafted XML document containing an empty string in an entity that is used in a large number of...

CVE-2026-40481

In monetr, versions 1.12.3 and earlier expose a denial-of-service risk where the public Stripe webhook endpoint buffers the entire request body into memory before validating the Stripe signature. An unauthenticated remote attacker can send oversized POST payloads to trigger uncontrolled memory gr...

@chrysb/alphaclaw (>=0.8.8, <=0.9.0) potentially affected by CVE-2026-42438 via openclaw (2026.4.9)

openclaw NPM version 2026.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw =0.8.8, =0.9.0 Source cves: CVE-2026-42438 Source advisory: SNYK:JS-OPENCLAW-16109682...

@chrysb/alphaclaw (>=0.8.7, <=0.9.0) potentially affected by CVE-2026-42434 via openclaw (>=2026.4.5, <=2026.4.9)

openclaw NPM version =2026.4.5, =0.8.7, =0.9.0 Source cves: CVE-2026-42434 Source advisory: SNYK:JS-OPENCLAW-16109679...

CVE-2026-40478 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly...

@chrysb/alphaclaw (>=0.8.7, <=0.9.0) potentially affected by CVE-2026-43568 via openclaw (>=2026.4.5, <=2026.4.9)

openclaw NPM version =2026.4.5, =0.8.7, =0.9.0 Source cves: CVE-2026-43568 Source advisory: OSV:GHSA-5GJC-GRVM-M88J...

@chrysb/alphaclaw (>=0.8.7, <=0.9.0) potentially affected by CVE-2026-43568 via openclaw (>=2026.4.5, <=2026.4.9)

openclaw NPM version =2026.4.5, =0.8.7, =0.9.0 Source cves: CVE-2026-43568 Source advisory: SNYK:JS-OPENCLAW-16109687...

@chrysb/alphaclaw (>=0.9.1-beta.0, <=0.9.5), @twsxtd/hapi-openclaw (>=0.1.0, <=0.1.8) +2 more potentially affected by CVE-2026-43583 via openclaw (>=2026.4.10, <=2026.4.12)

openclaw NPM version =2026.4.10, =0.9.1-beta.0, =0.1.0, =0.1.8 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-43583 Source advisory: SNYK:JS-OPENCLAW-16109727...

@chrysb/alphaclaw (>=0.8.8, <=0.9.5), @twsxtd/hapi-openclaw (>=0.1.0, <=0.1.8) +2 more potentially affected by CVE-2026-43566 via openclaw (>=2026.4.9, <=2026.4.12)

openclaw NPM version =2026.4.9, =0.8.8, =0.1.0, =0.1.8 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-43566 Source advisory: SNYK:JS-OPENCLAW-16109663...

CVE-2026-40286

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting XSS vulnerability was identified in the 'Member Registration' Cadastrar Sócio function. By injecting a payload into the 'Member Name' Nome Sócio field, the script is persistently stored ...

CVE-2026-40155

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if...

XML Injection

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to XML Injection du...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4390 more potentially affected by CVE-2026-41672 via @xmldom/xmldom (>=0.7.0, <=0.8.12)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.0.1, =0.0.2 - @abcd19/st-grid 3.1.0 and more Source cves: CVE-2026-41672 Source advisory: SNYK:JS-XMLDOMXMLDOM-16133132...

locizify (>=7.0.0, <=9.0.9), locizify-ssg (>=1.1.12, <=2.0.6) potentially affected by CVE-2026-41692 via i18nextify (>=4.0.0, <=4.0.7)

i18nextify NPM version =4.0.0, =7.0.0, =1.1.12, =2.0.6 Source cves: CVE-2026-41692 Source advisory: SNYK:JS-I18NEXTIFY-16415525...

CVE-2026-40155 Auth0 Next.js SDK has Improper Proxy Cache Lookup

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if...

CVE-2026-40155 Auth0 Next.js SDK has Improper Proxy Cache Lookup

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if...

CVE-2026-40299

The CVE-2026-40299 issue affects the next-intl library used with Next.js. The vulnerability arises in the middleware when localePrefix: 'as-needed' is enabled, allowing URL handling and the WHATWG URL parser to resolve a relative redirect target to another host. This can cause the browser to be r...