@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-18446 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-18446 Source advisory: OSV:GHSA-7P8R-X3MC-P8W7...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @donadiosolutions/lcm (1.4.2) +10 more potentially affected by CVE-2026-18446 via fast-uri (>=3.0.1, <=3.1.4)

fast-uri NPM version =3.0.1, =0.3.1, =1.2.0, =5.4.3, =0.1.0, =1.0.0, =1.0.0, =1.25.0, =0.1.5, =0.1.0, =2.2.0, =2.3.1 Source cves: CVE-2026-18446 Source advisory: OSV:GHSA-7P8R-X3MC-P8W7...

JLSEC-2026-1146

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these...

CVE-2026-18613

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

UBUNTU-CVE-2026-69151

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

03-gs-ee-6 (0.3.5), @alauda-fe/dynamic-plugin-sdk-rspack (>=0.0.1-alpha.5, <=0.0.1-alpha.12) +3101 more potentially affected by CVE-2026-69152 via brace-expansion (>=4.0.0, <=5.0.8)

brace-expansion NPM version =4.0.0, =0.0.1-alpha.5, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +21 more potentially affected by CVE-2026-69151 via @angular/compiler (>=21.0.0, <=21.2.17)

@angular/compiler NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =1.0.0-next.27766, =1.0.77-rc.1, =0.0.1, =0.5.11 - foliokit 0.0.0 and more Source cves: CVE-2026-69151 Source advisory:...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +332 more potentially affected by CVE-2026-69151 via @angular/core (>=19.0.0, <=19.2.25)

@angular/core NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 and more Source cves: CVE-2026-69151 Source advisory: OSV:GHSA-JJ27-H5HQ-8X99...

@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +36 more potentially affected by CVE-2026-69151 via @angular/compiler (>=20.0.0, <=20.3.21)

@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =0.0.57, =0.0.60 - @saritasa/renewaire-frontend-sdk 0.1.0-dev.101 and more Source cves: CVE-2026-69151 Source advisory:...

@amwaljs/checkout-angular (0.2.11), @augustalabs/ki-assistent (>=1.0.8, <=1.0.14) +21 more potentially affected by CVE-2026-69151 via @angular/compiler (>=21.0.0, <=21.2.17)

@angular/compiler NPM version =21.0.0, =1.0.8, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =1.0.0-next.27766, =1.0.77-rc.1, =0.0.1, =0.5.11 - foliokit 0.0.0 and more Source cves: CVE-2026-69151 Source advisory:...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.209-alpha) +57 more potentially affected by CVE-2026-69151 via @angular/core (>=21.0.0, <=21.2.17)

@angular/core NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =6.0.1, =2.0.1, =3.0.0 - @koalarx/ui 21.2.4 and more Source cves: CVE-2026-69151 Source advisory: OSV:GHSA-JJ27-H5HQ-8X99...

Exploit for Code Injection in Vmware Spring_Framework

PoC Spring4Shell CVE-2022-22965 Proof of Concept per lo sfr...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-69149 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-69149 Source advisory: OSV:GHSA-VPX6-8PJR-4G3V...

Exploit for CVE-2026-32621

CVE-2026-32621 - Apollo Federation Prototype Pollution PoC...

CVE-2026-18568 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-69088

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses spring-security-core-6.5.10.jar, form-data-4.0.5.tgz, ws-8.20.1.tgz, pythonmultipart-0.0.27-py3-none-any.whl, starlette-1.2.1-py3-none-any.whl, httpcore5-5.3.6.jar, httpcore5-h2-5.3.6.jar, mlflow-3.13.0-py3-none-any.whl, js-yaml-4.2.0.tgz and tar-7.5.16.tgz which ar...

Security Bulletin: IBM Maximo Application Suite - Predict Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Predict Component uses click-8.3.1-py3-none-any.whl,aiohttp-3.12.14-cp310-cp310-macosx109universal2.whl which are vulnerable to CVE-2026-7246, CVE-2025-69223, CVE-2025-69224, CVE-2025-69225, CVE-2025-69226, CVE-2025-69227, CVE-2025-69228, CVE-2025-69229,...

WordPress Photocart Link plugin <= 1.6 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by CrashBandicot @DosPerl in WordPress Plugin Photocart Link versions = 1.6...

CVE-2026-28147 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...