What needs attention now.

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

• Memory corruption

>=0.12.0, <1.6.2 · fixed in 1.6.2

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

• Authentication bypass
• CWE-348

>=1.1.0, <2.0.8 · fixed in 2.0.8

vm2: NodeVM custom resolution bypasses external path boundaries

• Broken access control

<3.12.2 · fixed in 3.12.2

CVE-2026-82989

• Viewsonic vCast
• Other injection
• CWE-147

Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

• twenty
• Hard-coded credentials

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

• CWE-346
• CWE-441

>=6.0.0, <6.2.2 || >=7.0.0, <7.6.9 || >=8.5.0, <8.5.1 || >=8.3.5, <8.4.3 || >=8.0.0, <=8.3.4 · fixed in 6.2.2, 7.6.9, 8.5.1, 8.4.3

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

• Prototype pollution

<2.1.1 · fixed in 2.1.1

Tinypool: Prototype Pollution Gadget to RCE in run() options

• Code injection
• Prototype pollution

<2.1.2 · fixed in 2.1.2

vm2: Sandbox Escape (NodeVM)

• CWE-913

<3.11.8 · fixed in 3.11.8

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process

• CWE-248
• CWE-703

>=3.10.0, <3.11.8 · fixed in 3.11.8

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

• Prototype pollution
• CWE-913

>=3.11.0, <3.11.8 · fixed in 3.11.8

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

• CWE-693

<3.11.8 · fixed in 3.11.8

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

• CWE-913

<3.11.7 · fixed in 3.11.7

vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

• Information disclosure
• CWE-653

<3.11.7 · fixed in 3.11.7

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

• CWE-693
• CWE-913

>=3.10.1, <3.11.7 · fixed in 3.11.7

Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass

• Authentication bypass

>=1.7.0, <1.9.1 · fixed in 1.9.1

Files accessible to external parties in Atlassian Bamboo Data Center and others

• Atlassian Bamboo Data Center
• Atlassian Bitbucket Data Center
• Information disclosure

openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

• OS4ED openSIS-Classic
• Broken access control

Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

• langflow
• Command injection

Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint

• Camunda 7
• Broken access control

Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color

• penpot
• Command injection

Apache Struts: OGNL injection in the legacy RESTful action mapper

• Apache Software Foundation Apache Struts
• Code injection

Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

• plane
• Hard-coded credentials

Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

• plane
• Authentication bypass

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

• plane
• Information disclosure
• Authentication bypass

Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

• plane
• Authentication bypass

WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability

• WP BASE Booking
• SQL injection

WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

• Liquid Web / StellarWP Advanced Post Manager
• Insecure deserialization

Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

• plane
• Broken access control

Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

• plane
• Server-side request forgery (SSRF)

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16

• ordasoft.com OrdaSoft Joomla CCK
• SQL injection

Improper authentication in Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out (iLO) 7

• Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out (iLO) 7
• Authentication bypass

Totolink A3002MU QoS Rule formIpQoS stack-based overflow

• Totolink A3002MU
• Memory corruption

Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization

• Totolink A3002MU
• Privilege escalation
• Broken access control

Authentication bypass via blank auth token in P4Search

• Perforce P4 (Helix Core)
• CWE-636

RCE via exposed JDWP debug agent in P4Search

• Perforce P4 (Helix Core)
• CWE-489

Authentication bypass via default auth token in P4Search

• Perfoce P4 (Helix Core)
• CWE-1392

YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes

• Code injection
• Insecure deserialization

Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig

• Legcord
• CWE-15

Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

• Legcord
• Path traversal

maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

• maclof kubernetes-client
• Weak cryptography or TLS

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter().

• SQL injection

GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.

• SQL injection

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export.

• Code injection

Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and t…

• Code injection

An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.

• Insecure deserialization

alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

• alexpechkarev google-maps
• Weak cryptography or TLS

Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

• defunkt gist
• Weak cryptography or TLS

gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

• go-pay gopay
• Weak cryptography or TLS

go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper

• go-micro
• Weak cryptography or TLS

WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title

• WWBN AVideo
• Cross-site scripting (XSS)

WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates

• WWBN AVideo
• Cross-site scripting (XSS)

ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

• zitadel
• Authentication bypass

ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

• zitadel
• Information disclosure

ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

• zitadel
• Broken access control

ZITADEL before 4.17.3 Account Takeover via External IdP Linking

• zitadel
• Authentication bypass

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

• Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
• SQL injection

InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection

• InternLM MindSearch
• Other injection
• Code injection

Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection

• AhsayCBS
• Command injection

Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication

• AhsayCBS
• Authentication bypass