// Sicherheitsradar
Aktuelle Lücken für Web und Tooling
Hier stehen alle hohen und kritischen Sicherheitslücken der letzten 30 Tage für die Technik, auf der die meisten Websites laufen: PHP, Node.js, WordPress, .NET, Webserver und die großen Paketverwaltungen. Die Liste füllt sich automatisch aus offiziellen Quellen und wird alle sechs Stunden aktualisiert.
Stand: 25. Oktober 2026, 01:25 Uhr
466
hohe und kritische Lücken in 30 Tagen
90
davon kritisch
0
werden nachweislich angegriffen
// Selbsttest
Ist meine Version betroffen?
Trag ein, welche Version bei dir läuft. Die Seite vergleicht sie mit den Lücken auf dieser Seite und mit den Support-Daten von endoflife.date. Das passiert in deinem Browser. Die Eingaben gehen nicht an den Server, und gescannt wird nichts.
So findest du die Version:
Das ist keine Versionsnummer. Gib sie so ein, wie sie angezeigt wird, etwa 8.2.24 oder 22.11.0.
Zweig bekommt Updates bis . Zweig bekommt nur noch bis Updates. Plane den Wechsel auf einen neueren Zweig. Zweig bekommt keine Updates mehr. Neue Lücken werden dort nicht geschlossen, hier hilft nur ein Wechsel auf einen neueren Zweig. Diese Version ist älter als alle Zweige, die noch geführt werden. Sie bekommt keine Updates mehr. Gib die Version genauer an, mindestens mit dem Zweig, etwa 8.3 oder 8.3.12. Zu diesem Zweig liegen keine Support-Daten vor. Prüfe die Nummer. Für hat der Radar keine Support-Daten, nur die Lücken.
Im Zweig gibt es schon . Deine Version ist älter, ein Update lohnt sich.
Das ist die neueste Version im Zweig ().
Die neueste Version im Zweig ist . Mit der vollen Nummer siehst du, ob deine dazu passt.
Die Nummer sieht nach einem Paket aus Debian, Ubuntu oder Red Hat aus. Dort werden Lücken oft behoben, ohne dass sich die Versionsnummer ändert. Ob eine CVE geschlossen ist, steht im Changelog des Pakets.
Für steht in den letzten 30 Tagen keine hohe oder kritische Lücke im Radar.
Das Ergebnis ist ein Anhaltspunkt, kein Urteil. Debian, Ubuntu und Red Hat flicken Lücken in ihren Paketen, ohne die Versionsnummer zu ändern. Ein PHP 8.2.7 aus Debian kann deshalb sicher sein, obwohl die Nummer alt aussieht. Außerdem kennt der Radar nur die Lücken der letzten 30 Tage.
Wie du bei PHP und Node.js die Version prüfst und das Update einspielst, steht in der Anleitung zu PHP2Shell und den Node.js-Lücken.
Lieber die eigene Website prüfen lassen?
Die Domain-Prüfung liest ab, welche Versionen deine Website nach außen zeigt, und vergleicht sie mit dem Radar. Sie läuft nur für Domains, auf denen du einen Nachweis hinterlegst.
Alle Lücken der letzten 30 Tage
-
hoch 8,8 CMS und Shops
WordPress-Plugin CVE-2026-110018
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the …
-
hoch 7,1 CMS und Shops
WordPress-Plugin CVE-2026-115807
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due …
-
kritisch 9,8 CMS und Shops
Prime Mover (WordPress-Plugin) CVE-2026-115806
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace …
-
hoch 7,1 Paket-Ökosysteme
virtualenv (pip) CVE-2026-113718
virtualenv: Xonsh activation literals depend on the script decoding codec
Behoben in 21.14.9
-
hoch 7,1 Paket-Ökosysteme
virtualenv (pip) CVE-2026-113723
virtualenv: Bash prompt values can change meaning under older compatibility modes
Behoben in 21.14.9
-
hoch 7,5 Paket-Ökosysteme
@azure/msal-node (npm) CVE-2026-109461
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
Behoben in 7.1.0
-
hoch 7,5 Paket-Ökosysteme
undici (npm) CVE-2026-109869
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
Behoben in 6.29.1, 7.30.1, 8.12.2
-
hoch 7,5 Paket-Ökosysteme
multer (npm) CVE-2026-113872
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
Behoben in 2.5.0
-
hoch 8,8 Paket-Ökosysteme
happy-dom (npm) CVE-2026-115895
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Behoben in 21.0.4
-
hoch 7,1 Paket-Ökosysteme
filelock (pip) CVE-2026-112940
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
Behoben in 4.2.1
-
kritisch 9,2 Paket-Ökosysteme
pillow (pip) CVE-2026-112398
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Behoben in 13.0.0
-
hoch 7,5 Paket-Ökosysteme
postal-mime (npm) GHSA-f2hq-32vh-53cc
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
Behoben in 4.0.8
-
kritisch 9,2 Paket-Ökosysteme
laravel/framework (Composer) CVE-2026-114509
Laravel TokenGuard authentication bypass through non-string API credentials
Behoben in 13.29.0, 12.68.0
-
hoch 7,5 Paket-Ökosysteme
vllm (pip) CVE-2026-114055
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)
Behoben in 0.31.0
-
hoch 7,1 Paket-Ökosysteme
pypdf (pip) CVE-2026-115572
pypdf: Possible long runtimes for repeated references to the same missing object
Behoben in 6.21.2
-
hoch 7,1 Paket-Ökosysteme
pypdf (pip) CVE-2026-115585
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
Behoben in 6.21.2
-
hoch 7,1 Paket-Ökosysteme
pypdf (pip) CVE-2026-115580
pypdf: Possible long runtimes for large xref table header limits
Behoben in 6.21.2
-
hoch 7,4 Paket-Ökosysteme
electron (npm) CVE-2026-115570
Electron: Mitigation for compromised eMudhra intermediate certificates
Behoben in 45.0.0-beta.6, 44.9.1, 43.8.1, 42.11.16
-
hoch 7,5 Paket-Ökosysteme
body-parser (npm) CVE-2026-111181
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
Behoben in 2.4.0, 1.20.9
-
hoch 8,6 Paket-Ökosysteme
strands-agents, @strands-agents/sdk (npm) CVE-2026-115419
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
Behoben in 1.43.0, 1.5.0
-
hoch 7,1 Paket-Ökosysteme
virtualenv (pip) CVE-2026-115586
virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)
Behoben in 21.14.13
-
hoch Paket-Ökosysteme
mistune (pip) CVE-2026-115355
Mistune: Path Traversal and XSS in Include directive
Behoben in 3.3.0
-
hoch 7,5 Paket-Ökosysteme
Twisted (pip) CVE-2026-115776
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
Behoben in 26.10.0rc1
-
hoch 7,5 Paket-Ökosysteme
Twisted (pip) CVE-2026-115778
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
Behoben in 26.10.0rc1
-
hoch 8,7 Paket-Ökosysteme
Twisted (pip) CVE-2026-115775
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree
Behoben in 26.10.0rc1
-
hoch 7,1 Paket-Ökosysteme
obsidian-tc (npm) CVE-2026-115478
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
Behoben in 1.31.4
-
kritisch 9,6 Paket-Ökosysteme
obsidian-tc (npm) CVE-2026-77363
obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
Behoben in 1.3.1
-
hoch 7,1 Paket-Ökosysteme
obsidian-tc (npm) CVE-2026-115477
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
Behoben in 1.31.4
-
kritisch 9,9 Paket-Ökosysteme
obsidian-tc (npm) CVE-2026-77366
obsidian-tc tokens can access arbitrary configured vaults
Behoben in 1.3.1
-
hoch 8,1 Paket-Ökosysteme
pillow (pip) GHSA-78g4-xqwv-q3g8
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
Behoben in 13.0.0
-
kritisch 9,5 Paket-Ökosysteme
next (npm) GHSA-673q-mjm6-r5xr
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
Behoben in 16.4.1
-
hoch 7,5 Paket-Ökosysteme
Gitpython (pip) CVE-2026-114145
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
Behoben in 3.2.1
-
hoch 8,8 Paket-Ökosysteme
tome (npm) CVE-2026-114142
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
Behoben in 5.0.1
-
hoch 8,7 Paket-Ökosysteme
toml (npm) CVE-2026-114141
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
Behoben in 5.0.1
-
hoch 8,7 Paket-Ökosysteme
toml (npm) CVE-2026-114143
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
Behoben in 5.0.1
-
hoch 7,5 Paket-Ökosysteme
toml (npm) CVE-2026-114144
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
Behoben in 5.0.1
-
hoch 8,7 Paket-Ökosysteme
storybook, @storybook/core, @storybook/core-server +3 (npm) CVE-2026-114126
Storybook dev server vulnerable to code injection from the local network
Behoben in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6
-
hoch 8,4 Paket-Ökosysteme
@graphql-tools/utils (npm) CVE-2026-114604
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
Behoben in 12.0.2
-
hoch 7,5 Paket-Ökosysteme
graphql-core (pip) CVE-2026-75508
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
Behoben in 3.2.12, 3.3.0rc1
-
hoch 7,5 Paket-Ökosysteme
graphql-core (pip) CVE-2026-75507
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
Behoben in 3.2.12, 3.3.0rc1
-
kritisch 9,2 Paket-Ökosysteme
dompurify (npm) GHSA-cg2g-xh64-v4q7
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
Behoben in 3.4.17
-
hoch 7,6 Paket-Ökosysteme
dompurify (npm) GHSA-mrv2-3pqr-j5jr
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
Behoben in 3.4.17
-
hoch 8,8 Paket-Ökosysteme
nbconvert (pip) CVE-2026-114140
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
Behoben in 7.17.2
-
hoch 8,7 Paket-Ökosysteme
black (pip) CVE-2026-114134
Black: GitHub Action installs unvalidated required-version from pyproject.toml
Behoben in 26.10.1
-
hoch 7,4 Paket-Ökosysteme
djangorestframework (pip) CVE-2026-114137
Django REST framework: TokenProxy.delete() reports success and revokes nothing
Behoben in 3.18.2
-
hoch 7,5 Paket-Ökosysteme
djangorestframework (pip) CVE-2026-114138
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
Behoben in 3.18.2
-
hoch 7,5 Paket-Ökosysteme
djangorestframework (pip) CVE-2026-114136
Django REST framework: JSONParser applies an attacker-named codec to the request stream
Behoben in 3.18.2
-
hoch 7,7 Paket-Ökosysteme
Pillow (pip) CVE-2026-96778
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Behoben in 13.0.0
-
hoch 7,1 Paket-Ökosysteme
Pillow (pip) CVE-2026-96644
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
Behoben in 13.0.0
-
hoch 7,1 Paket-Ökosysteme
Pillow (pip) CVE-2026-96643
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Behoben in 13.0.0
-
hoch 7,1 Paket-Ökosysteme
Pillow (pip) CVE-2026-96642
Pillow: TarIO negative size field causes infinite CPU-spin loop
Behoben in 13.0.0
-
hoch 8,2 Paket-Ökosysteme
Pillow (pip) CVE-2026-96640
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Behoben in 13.0.0
-
kritisch 9,8 Paket-Ökosysteme
Pillow (pip) CVE-2026-96639
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Behoben in 13.0.0
-
hoch 7,1 Paket-Ökosysteme
pillow (pip) CVE-2026-96637
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
Behoben in 13.0.0
-
kritisch 9,1 Paket-Ökosysteme
@sentry/nextjs (npm) CVE-2026-114139
Sentry-Javascript: Middleware Bypass when using Tunnel route
Behoben in 9.47.2, 10.75.2, 11.0.0-rc.1
-
kritisch 9,5 Paket-Ökosysteme
next (npm) GHSA-2464-fhr4-w9xw
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
Behoben in 15.5.28, 16.4.1
-
hoch 8,2 Paket-Ökosysteme
next (npm) CVE-2026-94482
Next.js: Denial of Service in App Router using Server Actions
Behoben in 15.5.28, 16.4.1
-
hoch 7,4 Paket-Ökosysteme
pyjwt (pip) GHSA-pxh4-856f-4h89
PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery
Behoben in 2.14.0
-
hoch 8,8 Paket-Ökosysteme
jupyter-server (pip) CVE-2026-114135
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
Behoben in 2.6.0
-
kritisch 9,2 Paket-Ökosysteme
brotli, brotlicffi (pip) GHSA-9v8h-qqgm-4m35
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
Behoben in 1.2.1, 1.2.1.0
-
kritisch 9,2 Paket-Ökosysteme
mem0ai (pip) CVE-2026-115324
mem0ai Databricks vector store vulnerable to SQL injection
Behoben in 1.0.8
-
hoch 7,8 Paket-Ökosysteme
virtualenv (pip) CVE-2026-113722
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
Behoben in 21.14.9
-
hoch 8,8 Paket-Ökosysteme
Pillow (pip) CVE-2026-112902
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
Behoben in 13.0.0
-
kritisch 9,2 Paket-Ökosysteme
Pillow (pip) CVE-2026-112393
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Behoben in 13.0.0
-
hoch 8,7 Paket-Ökosysteme
Pillow (pip) CVE-2026-112406
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
Behoben in 13.0.0
-
hoch 8,7 Paket-Ökosysteme
Pillow (pip) CVE-2026-112399
Pillow: APNG background disposal allocates full canvas before decompression bomb check
Behoben in 13.0.0
-
hoch 8,7 Paket-Ökosysteme
pillow (pip) CVE-2026-112892
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
Behoben in 13.0.0
-
hoch 8,7 Paket-Ökosysteme
Pillow (pip) CVE-2026-112894
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Behoben in 13.0.0
-
hoch 8,2 Paket-Ökosysteme
Pillow (pip) CVE-2026-112390
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
Behoben in 13.0.0
-
hoch 8,2 Paket-Ökosysteme
Pillow (pip) CVE-2026-112392
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Behoben in 13.0.0
-
hoch 8,7 Paket-Ökosysteme
pillow (pip) CVE-2026-112405
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
Behoben in 13.0.0
-
hoch 8,2 Paket-Ökosysteme
pillow (pip) CVE-2026-112893
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
Behoben in 13.0.0
-
hoch 8,7 Paket-Ökosysteme
Pillow (pip) CVE-2026-112402
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Behoben in 13.0.0
-
kritisch 9,2 Paket-Ökosysteme
Pillow (pip) CVE-2026-112900
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
Behoben in 13.0.0
-
kritisch 9,4 Paket-Ökosysteme
storybook, @storybook/core, @storybook/core-server +3 (npm) CVE-2026-114125
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Behoben in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6
-
hoch 7,8 Paket-Ökosysteme
virtualenv (pip) CVE-2026-113725
virtualenv bash activate runs commands from an environment name with a backslash before $
Behoben in 21.14.7
-
hoch 7,8 Paket-Ökosysteme
virtualenv (pip) CVE-2026-113726
virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST
Behoben in 21.14.4
-
hoch 7,8 Paket-Ökosysteme
virtualenv (pip) CVE-2026-113732
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote
Behoben in 21.14.2
-
hoch 7,8 Paket-Ökosysteme
virtualenv (pip) CVE-2026-113776
virtualenv activation scripts run code from a path that contains a placeholder name
Behoben in 21.14.2
-
kritisch 9,2 Laufzeiten und Kerne
PHP CVE-2026-109619
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request …
Behoben in 8.2.35, 8.3.36, 8.4.27, 8.5.12, 10.2.7, 11.1.4
-
kritisch 9,2 Laufzeiten und Kerne
PHP CVE-2026-109618
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized …
Behoben in 8.2.35, 8.3.36, 8.4.27, 8.5.12, 10.2.7, 11.1.4
-
hoch 7,5 Paket-Ökosysteme
apostrophe, @apostrophecms/import-export (npm) CVE-2026-113711
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
Behoben in 4.33.0, 3.7.0
-
hoch 8,7 Paket-Ökosysteme
Pillow (pip) CVE-2026-112397
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
Behoben in 13.0.0
-
hoch 8,7 Paket-Ökosysteme
Pillow (pip) CVE-2026-112400
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Behoben in 13.0.0
-
hoch 8,7 Paket-Ökosysteme
Pillow (pip) CVE-2026-112897
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Behoben in 13.0.0
-
hoch 8,8 Paket-Ökosysteme
Pillow (pip) CVE-2026-112896
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Behoben in 13.0.0
-
hoch 8,7 Paket-Ökosysteme
pillow (pip) CVE-2026-112895
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Behoben in 13.0.0
-
hoch 8,8 Paket-Ökosysteme
Pillow (pip) CVE-2026-112404
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Behoben in 13.0.0
-
kritisch 9,2 Paket-Ökosysteme
Pillow (pip) CVE-2026-112403
Pillow: Heap buffer overflow in ImagingJpegDecode
Behoben in 13.0.0
-
hoch 7,5 Paket-Ökosysteme
markdown-it (npm) CVE-2026-111758
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
Behoben in 14.3.3, 15.0.3
-
hoch 7,7 Paket-Ökosysteme
@modelcontextprotocol/server (npm) CVE-2026-111770
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
Behoben in 2.3.0
-
hoch 7,5 Paket-Ökosysteme
@modelcontextprotocol/sdk, @modelcontextprotocol/server (npm) CVE-2026-111768
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
Behoben in 1.32.0, 2.3.0
-
hoch 8,2 Paket-Ökosysteme
aiohttp (pip) CVE-2026-111066
AIOHTTP: File descriptor exhaustion in multipart requests
Behoben in 3.14.4
-
hoch 7,5 Paket-Ökosysteme
launch-editor, vite, vite-plus (npm) CVE-2026-112942
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
Behoben in 2.14.2, 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4
-
kritisch 9,1 Paket-Ökosysteme
uv (pip) GHSA-hq85-5cpj-mr62
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
Behoben in 0.13.4
-
kritisch 9,1 Paket-Ökosysteme
certifi (pip) GHSA-6q48-6c7w-9gw2
certifi bundles emSign root CAs with compromised intermediate CA keys
Behoben in 2026.10.19
-
hoch 8,6 Paket-Ökosysteme
@modelcontextprotocol/sdk (npm) CVE-2026-111767
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
Behoben in 1.32.0
-
hoch 7,5 Paket-Ökosysteme
apostrophe (npm) CVE-2026-113658
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
Behoben in 4.33.0
-
hoch 7,1 Paket-Ökosysteme
@apostrophecms/db-connect, apostrophe (npm) CVE-2026-113666
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
Behoben in 1.1.0, 4.33.0
-
hoch 8,2 Paket-Ökosysteme
follow-redirects (npm) CVE-2026-111756
follow-redirects array-form headers bypass cross-origin credential stripping
Behoben in 1.16.1
-
hoch 8,2 Paket-Ökosysteme
follow-redirects (npm) CVE-2026-111755
follow-redirects sensitiveHeaders regex escaping can expose credential headers
Behoben in 1.16.1
-
hoch 8,2 Paket-Ökosysteme
@angular/router (npm) CVE-2026-111751
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)
Behoben in 22.2.1, 21.2.25
-
hoch 8,2 Paket-Ökosysteme
@angular/router (npm) CVE-2026-111752
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
Behoben in 22.2.1, 21.2.25, 20.3.33
-
hoch 7,5 Paket-Ökosysteme
markdown-it (npm) CVE-2026-111759
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes
Behoben in 15.0.2, 14.3.2
-
hoch 8,8 Paket-Ökosysteme
mlflow (pip) CVE-2026-53995
MLflow FileStore trace IDs allow path traversal and arbitrary file writes
Behoben in 3.17.2
-
hoch 8,2 Paket-Ökosysteme
aiohttp (pip) CVE-2026-111064
aiohttp server lacks an initial request/header timeout
Behoben in 3.14.4
-
hoch 8,7 Paket-Ökosysteme
aiohttp (pip) GHSA-2g87-pp6c-29x5
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
Behoben in 3.14.4
-
kritisch 10,0 Paket-Ökosysteme
mercury (pip) CVE-2026-111057
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
Behoben in 3.2.4
-
kritisch 9,8 Paket-Ökosysteme
mercury (pip) CVE-2026-111058
Mercury: Unauthenticated Remote Code Execution via /api/kernels
Behoben in 3.2.6
-
hoch 7,1 Paket-Ökosysteme
loopx (pip) CVE-2026-108372
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
Behoben in 0.4.5
-
kritisch 9,8 Paket-Ökosysteme
lmcache (pip) CVE-2026-105192
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
Behoben in 0.5.6
-
kritisch 9,2 Paket-Ökosysteme
claude-agent-sdk (pip) CVE-2026-96620
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
Behoben in 0.2.121
-
kritisch 9,3 Paket-Ökosysteme
@tanstack/start-server-core, @tanstack/react-start, @tanstack/solid-start +1 (npm) CVE-2026-102989
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
Behoben in 1.169.39, 1.168.60, 1.168.57, 1.168.56
-
hoch 7,5 Paket-Ökosysteme
@anthropic-ai/claude-code (npm) CVE-2026-86063
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Behoben in 2.1.179
-
hoch 8,7 Paket-Ökosysteme
@builder.io/qwik, @qwik.dev/core (npm) CVE-2026-84994
Qwik: Crashing any Qwik Server via Resource thenable
Behoben in 1.20.0, 2.0.0-beta37
-
hoch 7,5 Paket-Ökosysteme
@opennextjs/cloudflare (npm) CVE-2026-100409
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
Behoben in 1.20.2
-
hoch 8,8 Paket-Ökosysteme
leantime/leantime (Composer) CVE-2026-85990
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
Behoben in 3.10.0
-
hoch 7,5 Paket-Ökosysteme
react/http (Composer) CVE-2026-104827
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
Behoben in 1.11.1
-
hoch 7,5 Paket-Ökosysteme
Microsoft.OpenApi.YamlReader, Microsoft.OpenApi.Readers (NuGet) CVE-2026-72923
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
Behoben in 3.10.0, 2.12.0, 1.6.30
-
hoch 8,8 CMS und Shops
FV Flowplayer Video Player (WordPress-Plugin) CVE-2026-86461
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type …
-
hoch 8,8 Paket-Ökosysteme
Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) CVE-2026-70035
Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability
Behoben in 10.0.13, 8.0.32, 9.0.21, 11.0.0-rc.2
-
hoch 7,5 Paket-Ökosysteme
Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm +8 (NuGet) CVE-2026-70186
Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability
Behoben in 8.0.32, 10.0.13, 9.0.21
-
hoch 8,8 Paket-Ökosysteme
Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) CVE-2026-70007
Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability
Behoben in 9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32
-
hoch 8,8 Paket-Ökosysteme
Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) CVE-2026-87697
Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability
Behoben in 9.0.21, 8.0.32, 11.0.0-rc.2, 10.0.13
-
hoch 7,8 Paket-Ökosysteme
Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm +5 (NuGet) CVE-2026-96225
Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability
Behoben in 8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
-
hoch 8,8 Paket-Ökosysteme
Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) CVE-2026-96230
Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability
Behoben in 10.0.13, 11.0.0-rc.2, 8.0.32, 9.0.21
-
hoch 7,5 Paket-Ökosysteme
Microsoft.AspNetCore.Authentication.Negotiate (NuGet) CVE-2026-70179
Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability
Behoben in 10.0.13, 8.0.32, 9.0.21
-
hoch 8,8 Paket-Ökosysteme
Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) CVE-2026-96224
Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability
Behoben in 10.0.13, 11.0.0-rc.2, 8.0.32, 9.0.21
-
hoch 8,8 Paket-Ökosysteme
Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) CVE-2026-85363
Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability
Behoben in 8.0.32, 10.0.13, 9.0.21, 11.0.0-rc.2
-
hoch 8,8 Paket-Ökosysteme
Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) CVE-2026-83520
Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability
Behoben in 11.0.0-rc.2, 10.0.13, 8.0.32, 9.0.21
-
hoch 8,8 Paket-Ökosysteme
Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) CVE-2026-70174
Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability
Behoben in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2
-
hoch 7,5 Paket-Ökosysteme
Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) CVE-2026-96232
Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability
Behoben in 11.0.0-rc.2, 9.0.21, 8.0.32, 10.0.13
-
hoch 8,8 Paket-Ökosysteme
Microsoft.WindowsDesktop.App.Runtime.win-arm64, Microsoft.WindowsDesktop.App.Runtime.win-x64, Microsoft.WindowsDesktop.App.Runtime.win-x86 (NuGet) CVE-2026-96235
Microsoft Security Advisory CVE-2026-96235 - .NET and Visual Studio Remote Code Execution Vulnerability
Behoben in 8.0.32, 10.0.13, 11.0.0-rc.2, 9.0.21
-
hoch 7,8 Paket-Ökosysteme
Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm +5 (NuGet) CVE-2026-96231
Microsoft Security Advisory CVE-2026-96231 - .NET and Visual Studio Elevation of Privilege Vulnerability
Behoben in 8.0.32, 10.0.13, 9.0.21, 11.0.0-rc.2
-
kritisch 9,1 Paket-Ökosysteme
Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm +8 (NuGet) CVE-2026-70188
Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability
Behoben in 11.0.0-rc.2, 8.0.32, 10.0.13, 9.0.21
-
hoch 7,5 Paket-Ökosysteme
Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm +8 (NuGet) CVE-2026-96236
Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability
Behoben in 8.0.32, 11.0.0-rc.2, 10.0.13, 9.0.21
-
hoch 8,1 Paket-Ökosysteme
Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86 (NuGet) CVE-2026-70197
Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability
Behoben in 8.0.32, 11.0.0-rc.2, 9.0.21, 10.0.13
-
hoch 7,5 Paket-Ökosysteme
Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm +8 (NuGet) CVE-2026-69651
Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability
Behoben in 9.0.21, 11.0.0-rc.2, 10.0.13, 8.0.32
-
hoch 8,8 Paket-Ökosysteme
Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) CVE-2026-102870
Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability
Behoben in 10.0.13, 11.0.0-rc.2.26478.115
-
hoch 7,5 Paket-Ökosysteme
Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm +9 (NuGet) CVE-2026-96233
Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability
Behoben in 10.0.13, 11.0.0-rc.2, 9.0.21, 8.0.32
-
hoch 7,5 Paket-Ökosysteme
System.Security.Cryptography.Pkcs (NuGet) CVE-2026-84008
Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability
Behoben in 10.0.13, 11.0.0-rc.2, 8.0.2, 9.0.21
-
hoch 7,5 Paket-Ökosysteme
Microsoft.NETCore.App.Runtime.linux-arm, Microsoft.NETCore.App.Runtime.linux-arm64, Microsoft.NETCore.App.Runtime.linux-musl-arm +9 (NuGet) CVE-2026-58280
Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability
Behoben in 9.0.21, 8.0.32, 10.0.13, 11.0.0-rc.2
-
hoch 7,5 Paket-Ökosysteme
Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm +9 (NuGet) CVE-2026-70183
Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability
Behoben in 8.0.32, 10.0.13, 9.0.21, 11.0.0-rc.2
-
kritisch 9,8 Paket-Ökosysteme
Microsoft.Native.Quic.MsQuic.Schannel (NuGet) CVE-2026-105016
Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability
Behoben in 2.5.11-ci.159417053
-
hoch 7,5 Paket-Ökosysteme
Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm +9 (NuGet) CVE-2026-70181
Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability
Behoben in 9.0.21, 10.0.13, 8.0.32
-
hoch 8,1 Paket-Ökosysteme
Microsoft.AspNetCore.App.Runtime.linux-arm, Microsoft.AspNetCore.App.Runtime.linux-arm64, Microsoft.AspNetCore.App.Runtime.linux-musl-arm +9 (NuGet) CVE-2026-70175
Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability
Behoben in 9.0.21, 10.0.13, 8.0.32
-
hoch 7,5 Paket-Ökosysteme
Microsoft.AspNetCore.SignalR.Common (NuGet) CVE-2026-70159
Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability
Behoben in 10.0.13, 11.0.0-rc.2, 8.0.32, 9.0.21
-
hoch 7,5 Laufzeiten und Kerne
.NET / ASP.NET Core CVE-2026-96960
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
Behoben in 8.0.5, 9.0.21, 10.0.13
-
hoch 7,5 Laufzeiten und Kerne
.NET / ASP.NET Core CVE-2026-96959
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
Behoben in 8.0.5, 9.0.21, 10.0.13
-
hoch 7,5 Laufzeiten und Kerne
.NET / ASP.NET Core CVE-2026-96958
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Behoben in 8.0.5, 9.0.21, 10.0.13
-
hoch 8,8 Laufzeiten und Kerne
.NET / ASP.NET Core CVE-2026-96957
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
Behoben in 10.0.13, 17.14.42, 18.10.4
-
hoch 7,4 Laufzeiten und Kerne
.NET / ASP.NET Core CVE-2026-96222
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Behoben in 10.0.14393.9612, 10.0.17763.9376, 10.0.20348.5761, 10.0.26100.33650, 8.0.5, 17.14.42
-
kritisch 9,4 Laufzeiten und Kerne
.NET / ASP.NET Core CVE-2026-88092
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
Behoben in 8.0.32, 9.0.21, 10.0.13, 17.14.42, 18.10.4
-
hoch 8,2 Paket-Ökosysteme
@tinacms/cli (npm) CVE-2026-108259
Tina: Code injection via unescaped Git branch name in generated client source
Behoben in 3.0.0
-
kritisch 9,3 Paket-Ökosysteme
tinacms, @tinacms/app (npm) CVE-2026-108261
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
Behoben in 3.14.0, 2.5.14
-
hoch 7,6 Paket-Ökosysteme
@tinacms/web-components (npm) CVE-2026-108260
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
Behoben in 0.2.1
-
kritisch 9,3 Paket-Ökosysteme
contao/comments-bundle (Composer) CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
Behoben in 5.3.50, 5.7.12
-
hoch 8,1 Paket-Ökosysteme
pyload-ng (pip) GHSA-68w4-83fh-f2w8
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
-
hoch 7,5 Paket-Ökosysteme
pyload-ng (pip) GHSA-jq7h-wrvp-3rgx
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
-
hoch 7,5 Paket-Ökosysteme
pyload-ng (pip) GHSA-889w-m37p-88m5
pyLoad: Api.set_user_permission never invalidates the target's session
-
hoch 7,7 Paket-Ökosysteme
pyload-ng (pip) GHSA-fr26-jjhm-638c
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
-
hoch 8,1 Paket-Ökosysteme
pyload-ng (pip) GHSA-r44w-v6gf-x3p6
pyLoad has an authentication bypass in API key validation (check_apikey cache)
Behoben in 0.5.0b3.dev101
-
hoch 7,5 Paket-Ökosysteme
strawberry-graphql (pip) CVE-2026-107728
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
Behoben in 0.326.1
-
hoch 7,4 Paket-Ökosysteme
fast-jwt (npm) CVE-2026-107720
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set
Behoben in 6.3.1
-
kritisch 9,8 Paket-Ökosysteme
fast-jwt (npm) CVE-2026-107722
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
Behoben in 6.3.0
-
hoch 8,1 Paket-Ökosysteme
fast-jwt (npm) CVE-2026-107723
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array
Behoben in 6.3.0
-
hoch 7,4 Paket-Ökosysteme
fast-jwt (npm) CVE-2026-107724
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery
Behoben in 6.3.0
-
hoch 8,6 Paket-Ökosysteme
praisonai (npm) CVE-2026-61426
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
Behoben in 1.7.3
-
hoch 7,1 Paket-Ökosysteme
praisonai-platform (pip) CVE-2026-61442
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass
Behoben in 0.1.9
-
hoch 8,8 Paket-Ökosysteme
praisonai (pip) CVE-2026-61434
PraisonAI: Shell command allowlist bypass via find -exec built-in action
Behoben in 4.6.78
-
kritisch 9,9 Paket-Ökosysteme
praisonai (pip) CVE-2026-61445
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
Behoben in 4.6.78
-
hoch 7,3 Paket-Ökosysteme
praisonai (pip) CVE-2026-61427
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
Behoben in 4.6.78
-
hoch 8,7 Paket-Ökosysteme
praisonai (pip) CVE-2026-60085
PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
Behoben in 4.6.78
-
hoch 7,2 Paket-Ökosysteme
praisonai (pip) CVE-2026-60091
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
Behoben in 4.6.78
-
hoch 7,5 Paket-Ökosysteme
pydantic-ai, pydantic-ai-slim (pip) CVE-2026-107286
Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early
Behoben in 2.53.0
-
hoch 7,4 Paket-Ökosysteme
mariadb (npm) CVE-2026-107385
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
Behoben in 3.2.5, 3.3.4, 3.4.7, 3.5.4
-
hoch 8,1 Paket-Ökosysteme
mariadb (npm) CVE-2026-107384
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
Behoben in 3.2.5, 3.3.4, 3.4.7, 3.5.4
-
hoch 7,5 Paket-Ökosysteme
mariadb (npm) CVE-2026-107383
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
Behoben in 3.2.5, 3.3.4, 3.4.7, 3.5.4
-
hoch 8,7 Paket-Ökosysteme
cairosvg (pip) CVE-2026-107378
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
Behoben in 2.9.1
-
hoch 7,8 Paket-Ökosysteme
praisonai (pip) CVE-2026-61433
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source
Behoben in 4.6.78
-
hoch 8,2 Paket-Ökosysteme
praisonai (pip) CVE-2026-61435
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header
Behoben in 4.6.78
-
hoch 7,5 Paket-Ökosysteme
datamodel-code-generator (pip) CVE-2026-107377
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
Behoben in 0.81.0
-
kritisch 9,8 Paket-Ökosysteme
handlebars (npm) CVE-2026-106446
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
Behoben in 4.7.10
-
kritisch 9,2 Paket-Ökosysteme
handlebars (npm) CVE-2026-106445
Handlebars: JavaScript Injection via Own Property Check Bypass
Behoben in 4.7.10
-
hoch 8,8 Paket-Ökosysteme
generator-jhipster (npm) CVE-2026-107375
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
Behoben in 9.4.0
-
hoch 7,6 Paket-Ökosysteme
generator-jhipster, react-jhipster (npm) CVE-2026-107303
JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
Behoben in 9.4.0, 1.1.0
-
hoch 7,5 Paket-Ökosysteme
msgpack5 (npm) CVE-2026-107302
msgpack5: Truncated map32 headers throw an unexpected error
Behoben in 6.1.0
-
hoch 7,5 Paket-Ökosysteme
msgpack5 (npm) CVE-2026-107300
msgpack5: Many buffered values can exhaust the streaming decoder stack
Behoben in 6.1.0
-
hoch 7,6 Paket-Ökosysteme
pydantic-ai, pydantic-ai-slim (pip) CVE-2026-107295
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
Behoben in 1.107.4, 2.28.0
-
hoch 8,1 Paket-Ökosysteme
praisonaiagents (pip) CVE-2026-61443
PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
Behoben in 1.6.78
-
hoch 7,8 Paket-Ökosysteme
praisonaiagents (pip) CVE-2026-61437
PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow
Behoben in 1.6.78
-
hoch 8,4 Paket-Ökosysteme
praisonaiagents (pip) CVE-2026-61446
PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
Behoben in 1.6.78
-
kritisch 10,0 Paket-Ökosysteme
praisonaiagents (pip) CVE-2026-61447
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets
Behoben in 1.6.78
-
hoch 8,5 Paket-Ökosysteme
praisonaiagents (pip) CVE-2026-61430
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
Behoben in 1.6.78
-
hoch 7,5 Paket-Ökosysteme
PraisonAI (pip) CVE-2026-61439
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
Behoben in 4.6.78
-
hoch 8,8 Paket-Ökosysteme
ghost (npm) CVE-2026-105642
Ghost: Remote Code Execution via Bookmark Card Images
Behoben in 6.67.0
-
hoch 7,3 Paket-Ökosysteme
ghost (npm) CVE-2026-105643
Ghost: Stored XSS via Embed Card Previews
Behoben in 6.67.0
-
hoch 7,5 Paket-Ökosysteme
docling, docling-slim (pip) CVE-2026-105744
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Behoben in 2.132.0
-
kritisch 9,9 Paket-Ökosysteme
langflow, langflow-base, lfx (pip) CVE-2026-105697
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration
Behoben in 1.10.3, 0.10.3
-
hoch 7,3 Paket-Ökosysteme
ghost (npm) CVE-2026-105649
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
Behoben in 6.65.0
-
hoch 7,1 Paket-Ökosysteme
langflow (pip) CVE-2026-105699
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
Behoben in 1.9.1
-
hoch 8,3 Paket-Ökosysteme
next (npm) CVE-2026-94483
Next.js has Server-Side Request Forgery in Image Optimization
Behoben in 16.3.8
-
hoch 8,6 Paket-Ökosysteme
@payloadcms/db-sqlite, @payloadcms/db-d1-sqlite, @payloadcms/db-postgres +1 (npm) CVE-2026-105856
Payload: SQL injection in SQLite/Postgres
Behoben in 3.90.0, 3.73.0, 4.0.0-canary.34
-
hoch 8,1 Paket-Ökosysteme
payload (npm) CVE-2026-105858
Payload: Remote Code Execution through first-register
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 7,1 Paket-Ökosysteme
@payloadcms/plugin-multi-tenant (npm) CVE-2026-105860
Payload has a tenant authorization bypass in Multi-Tenant Plugin
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 7,2 Paket-Ökosysteme
payload (npm) CVE-2026-105861
Payload external upload trust validation issue
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 8,7 Paket-Ökosysteme
payload (npm) CVE-2026-105862
Payload: Bypassed sanitization of user uploaded SVGs
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 8,1 Paket-Ökosysteme
payload (npm) CVE-2026-105865
Payload: Incomplete validation during the upload file lifecycle
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 7,1 Paket-Ökosysteme
@payloadcms/storage-s3 (npm) CVE-2026-105867
Payload: Client uploads could overwrite S3 objects
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 8,6 Paket-Ökosysteme
payload (npm) CVE-2026-105868
Payload: Uploaded XML files could execute same-origin JavaScript
Behoben in 3.90.0, 4.0.0-canary.34
-
kritisch 10,0 Paket-Ökosysteme
@payloadcms/plugin-form-builder (npm) CVE-2026-105857
Payload Form Builder has an RCE issue
Behoben in 3.90.0, 4.0.0-canary.34
-
kritisch 9,8 Paket-Ökosysteme
payload (npm) CVE-2026-105859
Payload: Unauthorized update to collection documents
Behoben in 3.90.0, 4.0.0-canary.34
-
kritisch 9,2 Paket-Ökosysteme
payload (npm) CVE-2026-105863
Payload authentication token field handling issue
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 8,1 Paket-Ökosysteme
ghost (npm) CVE-2026-105650
Ghost: Stored XSS via oEmbed Photo Responses
Behoben in 6.64.0
-
hoch 7,3 Paket-Ökosysteme
ghost (npm) CVE-2026-105651
Ghost: Stored XSS via Bookmark Card Images
Behoben in 6.64.0
-
hoch 7,5 Paket-Ökosysteme
ghost (npm) CVE-2026-105675
Ghost: Invite Token Disclosure in Ghost Admin API
Behoben in 6.64.0
-
hoch 7,2 Paket-Ökosysteme
ghost (npm) CVE-2026-105677
Ghost: Remote Code Execution via Theme Translation Files
Behoben in 6.64.0
-
hoch 7,3 Paket-Ökosysteme
ghost (npm) CVE-2026-105679
Ghost: Stored XSS via File Uploads on Local Storage
Behoben in 6.64.0
-
hoch 7,7 Paket-Ökosysteme
@backstage/plugin-techdocs-node (npm) CVE-2026-106455
Backstage: Improper validation of MkDocs plugin configuration in TechDocs
Behoben in 1.14.7, 1.15.5
-
hoch 8,5 Paket-Ökosysteme
@backstage/plugin-scaffolder-backend-module-sentry (npm) CVE-2026-106459
Backstage: Improper input validation in Sentry scaffolder actions
Behoben in 0.3.8
-
hoch 7,5 Paket-Ökosysteme
SixLabors.ImageSharp (NuGet) CVE-2026-106115
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
Behoben in 4.1.2
-
hoch 7,5 Paket-Ökosysteme
SixLabors.ImageSharp (NuGet) CVE-2026-106112
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
Behoben in 4.1.2
-
hoch 7,5 Paket-Ökosysteme
SixLabors.ImageSharp (NuGet) CVE-2026-106110
ImageSharp: TIFF CCITT T4 encoder can write past its compressed output buffer
Behoben in 4.1.2
-
hoch 7,5 Paket-Ökosysteme
SixLabors.ImageSharp (NuGet) CVE-2026-106113
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
Behoben in 4.1.2
-
hoch 7,8 Paket-Ökosysteme
hydra-optuna-sweeper (pip) CVE-2026-106440
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
Behoben in 1.3.0, 1.4.0.dev10
-
hoch 8,5 Paket-Ökosysteme
hydra-core (pip) CVE-2026-106439
Hydra: Mutable instantiate policy sets allow target blocklist bypass
Behoben in 1.3.7, 1.4.0.dev10
-
hoch 8,5 Paket-Ökosysteme
praisonaiagents (pip) CVE-2026-61429
PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
Behoben in 1.6.78
-
hoch 8,8 Paket-Ökosysteme
WeasyPrint (pip) CVE-2026-106443
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
Behoben in 70.0
-
hoch 7,2 Paket-Ökosysteme
kunstmaan/media-bundle, kunstmaan/bundles-cms (Composer) CVE-2026-104890
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
Behoben in 7.3.2
-
kritisch 10,0 Paket-Ökosysteme
vm2 (npm) CVE-2026-93605
vm2 contains a sandbox escape vulnerability
Behoben in 3.12.1
-
hoch 7,8 Paket-Ökosysteme
hydra-core (pip) CVE-2026-106441
Hydra logging configuration permits unsafe callable resolution
Behoben in 1.3.6, 1.4.0.dev9
-
hoch 7,8 Paket-Ökosysteme
hydra-core (pip) CVE-2026-106442
Hydra instantiate target blacklist bypasses permit code execution
Behoben in 1.3.6, 1.4.0.dev9
-
hoch 7,5 Paket-Ökosysteme
@insumermodel/mppx-condition-gate, @insumermodel/mppx-token-gate (npm) CVE-2026-104891
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
Behoben in 3.0.0, 1.0.4
-
hoch 7,7 Paket-Ökosysteme
@backstage/plugin-techdocs-node (npm) CVE-2026-106510
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
Behoben in 1.15.4
-
hoch 8,8 Paket-Ökosysteme
@backstage/plugin-techdocs-node (npm) CVE-2026-106558
Backstage: Improper validation of TechDocs MkDocs configuration
Behoben in 1.15.4
-
hoch 7,1 Paket-Ökosysteme
@backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm) CVE-2026-106560
Backstage: Improper repository path validation in a Scaffolder backend module
Behoben in 0.3.25
-
hoch 8,5 Paket-Ökosysteme
@backstage/plugin-scaffolder-backend-module-bitbucket-cloud, @backstage/plugin-scaffolder-backend-module-bitbucket-server (npm) CVE-2026-106486
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions
Behoben in 0.3.10, 0.2.25
-
hoch 8,1 Paket-Ökosysteme
@backstage/plugin-auth-backend-module-oidc-provider (npm) CVE-2026-106488
Backstage: Improper authentication in the OIDC provider
Behoben in 0.4.20
-
hoch 7,6 Paket-Ökosysteme
@backstage/backend-defaults (npm) CVE-2026-106492
Backstage: Improper preservation of access restrictions during service credential delegation
Behoben in 0.17.8
-
hoch 7,7 Paket-Ökosysteme
@backstage/plugin-catalog-backend (npm) CVE-2026-106498
Backstage: Improper URL validation in catalog entity placeholder resolution
Behoben in 3.9.1
-
kritisch 9,6 Paket-Ökosysteme
@backstage/plugin-scaffolder-backend (npm) CVE-2026-106501
Backstage: Sensitive information exposure in Scaffolder
Behoben in 3.3.1, 3.4.1, 4.0.3, 4.1.0
-
hoch 8,1 Paket-Ökosysteme
@backstage/plugin-scaffolder-backend (npm) CVE-2026-106503
Backstage: Scaffolder action input authorization bypass
Behoben in 3.3.1, 3.4.1, 4.0.3, 4.1.0
-
hoch 8,5 Paket-Ökosysteme
@backstage/plugin-scaffolder-backend (npm) CVE-2026-106500
Backstage: Improper task state validation in Scaffolder backend
Behoben in 4.1.0
-
hoch 7,7 Paket-Ökosysteme
@backstage/plugin-techdocs-node (npm) CVE-2026-106505
Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend
Behoben in 1.15.4
-
hoch 7,7 Paket-Ökosysteme
@backstage/plugin-techdocs-node (npm) CVE-2026-106509
Backstage: Improper validation of MkDocs theme configuration in TechDocs
Behoben in 1.15.4
-
hoch 7,7 Paket-Ökosysteme
@backstage/plugin-techdocs-node (npm) CVE-2026-106557
Backstage has improper input validation in TechDocs Markdown extension configuration
Behoben in 1.15.4
-
hoch 7,1 Paket-Ökosysteme
@payloadcms/db-mongodb (npm) CVE-2026-106100
Payload: Field-level write access bypass in Payload on MongoDB
Behoben in 3.87.0, 4.0.0-canary.20
-
hoch 7,5 Paket-Ökosysteme
ImageSharp (NuGet) CVE-2026-106118
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
Behoben in 4.1.1
-
hoch 7,5 Paket-Ökosysteme
ImageSharp (NuGet) CVE-2026-106117
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
Behoben in 3.2.0, 4.1.1
-
hoch 7,1 Paket-Ökosysteme
langflow (pip) CVE-2026-105741
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
Behoben in 1.10.3
-
kritisch 9,0 Paket-Ökosysteme
flowise, flowise-components (npm) CVE-2026-73487
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
Behoben in 3.1.3
-
kritisch 9,4 Paket-Ökosysteme
flowise, flowise-components (npm) CVE-2026-73483
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
Behoben in 3.1.3
-
hoch 8,4 Paket-Ökosysteme
@quasar/ssl-certificate, @quasar/cli, @quasar/app-vite (npm) CVE-2026-106105
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
Behoben in 2.1.0, 5.0.4, 3.3.0
-
hoch 7,1 Paket-Ökosysteme
@quasar/render-ssr-error, @quasar/app-vite (npm) CVE-2026-106106
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
Behoben in 2.2.4, 3.3.0
-
hoch 8,3 Paket-Ökosysteme
@quasar/app-vite (npm) CVE-2026-106107
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
Behoben in 3.3.0
-
hoch 8,7 Paket-Ökosysteme
quasar (npm) CVE-2026-106104
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Behoben in 2.23.3
-
kritisch 10,0 Paket-Ökosysteme
quasar (npm) CVE-2026-106102
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Behoben in 2.22.0
-
hoch 7,1 Paket-Ökosysteme
@quasar/icongenie (npm) CVE-2026-106103
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
Behoben in 6.1.1
-
kritisch 9,1 Paket-Ökosysteme
PraisonAI (pip) CVE-2026-62176
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
Behoben in 4.6.78
-
hoch 8,6 Paket-Ökosysteme
praisonai (pip) CVE-2026-61436
PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
Behoben in 4.6.78
-
hoch 7,3 Paket-Ökosysteme
praisonai (pip) CVE-2026-61428
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
Behoben in 4.6.78
-
hoch 7,1 Paket-Ökosysteme
@actual-app/sync-server (npm) CVE-2026-57449
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
Behoben in 26.7.0
-
hoch 7,1 Paket-Ökosysteme
wger (pip) CVE-2026-46434
wger: Trainer Privilege Escalation - Improper Privilege Management
-
hoch 7,1 Paket-Ökosysteme
wger (pip) CVE-2026-43976
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
-
hoch 7,8 Paket-Ökosysteme
knowns (npm) CVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
Behoben in 0.30.0
-
hoch 7,6 Paket-Ökosysteme
payload (npm) CVE-2026-105855
Payload didn't enforce field-level password update restrictions
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 8,7 Paket-Ökosysteme
payload (npm) CVE-2026-105854
Payload: ReDoS in Multipart Content-Type Validation
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 7,7 Paket-Ökosysteme
payload (npm) CVE-2026-105849
Payload vulnerable to API key disclosure through ordinary document reads
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 8,8 Paket-Ökosysteme
@payloadcms/plugin-ecommerce (npm) CVE-2026-105850
Payload Ecommerce has an order confirmation validation issue
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 7,1 Paket-Ökosysteme
payload (npm) CVE-2026-105853
Payload: Token refresh and password reset responses may expose restricted user fields
Behoben in 3.90.0, 4.0.0-canary.34
-
kritisch 9,3 Paket-Ökosysteme
payload (npm) CVE-2026-105851
Payload: Field access control bypass on auth collections
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 8,6 Paket-Ökosysteme
@payloadcms/plugin-mcp (npm) CVE-2026-105806
Payload: Improper access control for MCP API keys
Behoben in 3.88.0
-
kritisch 9,3 Paket-Ökosysteme
@payloadcms/plugin-import-export (npm) CVE-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
Behoben in 3.88.0, 4.0.0-canary.27
-
kritisch 9,8 Paket-Ökosysteme
payload (npm) CVE-2026-105845
Payload: SQL Injection in SQLite and Postgres
Behoben in 3.88.0, 4.0.0-canary.27
-
hoch 7,1 Paket-Ökosysteme
payload (npm) CVE-2026-105847
Payload: Polymorphic join queries could disclose hidden fields
Behoben in 3.90.0, 4.0.0-canary.34
-
hoch 8,8 Paket-Ökosysteme
Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder (NuGet) CVE-2026-105796
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
Behoben in 1.35.0
-
hoch 7,5 Paket-Ökosysteme
@modelcontextprotocol/sdk, @modelcontextprotocol/client (npm) CVE-2026-104850
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
Behoben in 1.31.0, 2.2.0
-
kritisch 9,1 Paket-Ökosysteme
Microsoft.Native.Quic.MsQuic.OpenSSL (NuGet) CVE-2026-105794
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
Behoben in 2.4.20, 2.5.11, 2.6.1
-
hoch 8,4 Paket-Ökosysteme
openapi-python-client (pip) CVE-2026-105801
openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation
Behoben in 0.29.1
-
hoch 8,9 Paket-Ökosysteme
sharp (npm) GHSA-wq5f-xc86-pv6w
sharp : Vulnerability in librsvg dependency CVE-2026-96889
Behoben in 0.35.5
-
kritisch 9,2 Paket-Ökosysteme
shell-quote (npm) CVE-2026-102422
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
Behoben in 1.11.0
-
kritisch 9,9 Paket-Ökosysteme
langflow (pip) CVE-2026-10561
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
Behoben in 1.10.1
-
kritisch 9,2 Paket-Ökosysteme
@simple-git/argv-parser (npm) CVE-2026-102829
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
Behoben in 2.0.1
-
kritisch 9,2 Paket-Ökosysteme
simple-git (npm) CVE-2026-102828
simple-git unsafe-operation guard does not block trailer command configuration
Behoben in 4.0.1
-
hoch 8,1 Paket-Ökosysteme
simple-git (npm) CVE-2026-102826
simple-git allows command execution through unblocked Git configuration includes
Behoben in 4.0.0
-
hoch 8,1 Paket-Ökosysteme
simple-git (npm) CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
Behoben in 4.0.0
-
hoch 7,5 Paket-Ökosysteme
pymongo (pip) CVE-2026-96749
PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encoding
Behoben in 4.18.2
-
hoch 8,3 Paket-Ökosysteme
pymongo (pip) CVE-2026-96748
PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters
Behoben in 4.18.2
-
hoch 7,5 Paket-Ökosysteme
@socket.io/cluster-engine (npm) CVE-2026-102600
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
Behoben in 0.1.1
-
kritisch 9,8 Paket-Ökosysteme
seroval (npm) CVE-2026-104846
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
Behoben in 1.6.2
-
hoch 7,5 Paket-Ökosysteme
seroval (npm) CVE-2026-104845
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Behoben in 1.6.3
-
kritisch 9,1 Paket-Ökosysteme
proxy-addr (npm) CVE-2026-90711
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Behoben in 2.0.8
-
hoch 7,3 Paket-Ökosysteme
@nx/docker (npm) CVE-2026-104859
@nx/docker: OS command injection in the @nx/docker release pipeline
Behoben in 22.7.8, 23.1.1
-
hoch 8,5 Paket-Ökosysteme
nx (npm) GHSA-w2vw-w76x-qr89
Nx: OS command injection via git revisions and remote refs
Behoben in 22.7.8, 23.1.1
-
hoch 8,5 Paket-Ökosysteme
nx (npm) CVE-2026-104854
Nx daemon and plugin worker sockets are accessible to other local users
Behoben in 22.7.9, 23.1.2
-
hoch 7,5 Paket-Ökosysteme
compression (npm) CVE-2026-87776
compression vulnerable to Denial of Service via memory leak on premature response close
Behoben in 1.8.2
-
kritisch 9,5 Paket-Ökosysteme
vm2 (npm) CVE-2026-100721
vm2: NodeVM custom resolution bypasses external path boundaries
Behoben in 3.12.2
-
hoch 8,9 Paket-Ökosysteme
vm2 (npm) CVE-2026-100722
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
Behoben in 3.12.2
-
hoch 7,4 Paket-Ökosysteme
@graphql-tools/executor-legacy-ws (npm) CVE-2026-103921
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
Behoben in 1.1.35
-
hoch 8,2 Paket-Ökosysteme
@graphql-tools/utils (npm) CVE-2026-104852
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
Behoben in 12.0.1
-
hoch 8,8 Paket-Ökosysteme
fsspec (pip) CVE-2026-104851
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
Behoben in 2026.6.0
-
kritisch 9,3 Paket-Ökosysteme
@capacitor/android, @capacitor/ios, github.com/ionic-team/capacitor-swift-pm +1 (npm) CVE-2026-103922
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Behoben in 6.2.2, 7.6.9, 8.5.1, 8.4.3
-
hoch 7,2 Paket-Ökosysteme
@vue/server-renderer (npm) GHSA-g2v6-rqmx-r4w6
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
Behoben in 3.5.42, 3.6.0-rc.6
-
kritisch 9,5 Paket-Ökosysteme
tinypool (npm) CVE-2026-104848
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
Behoben in 2.1.1
-
kritisch 9,5 Paket-Ökosysteme
tinypool (npm) CVE-2026-104849
Tinypool: Prototype Pollution Gadget to RCE in run() options
Behoben in 2.1.2
-
hoch 7,5 Paket-Ökosysteme
quart (pip) GHSA-v853-p72q-4cfw
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
Behoben in 0.23.1
-
hoch 7,6 Paket-Ökosysteme
langgraph-sdk (pip) CVE-2026-104873
LangGraph SDK custom auth silently ignores actions= on resource decorators
Behoben in 0.4.4
-
hoch 7,1 Paket-Ökosysteme
vm2 (npm) CVE-2026-92959
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
Behoben in 3.11.8
-
kritisch 10,0 Paket-Ökosysteme
vm2 (npm) CVE-2026-92955
vm2: Sandbox Escape (NodeVM)
Behoben in 3.11.8
-
kritisch 9,2 Paket-Ökosysteme
vm2 (npm) CVE-2026-92954
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Behoben in 3.11.8
-
kritisch 9,3 Paket-Ökosysteme
vm2 (npm) CVE-2026-92953
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
Behoben in 3.11.8
-
kritisch 9,5 Paket-Ökosysteme
vm2 (npm) CVE-2026-92934
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
Behoben in 3.11.8
-
hoch 8,5 Paket-Ökosysteme
prosemirror-view (npm) CVE-2026-104847
ProseMirror has a XSS vulnerability in prosemirror-view's paste handling
Behoben in 1.42.3
-
hoch 7,5 Paket-Ökosysteme
vm2 (npm) CVE-2026-92942
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
Behoben in 3.11.7
-
kritisch 10,0 Paket-Ökosysteme
vm2 (npm) CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Behoben in 3.11.7
-
kritisch 10,0 Paket-Ökosysteme
vm2 (npm) CVE-2026-92947
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
Behoben in 3.11.7
-
kritisch 10,0 Paket-Ökosysteme
vm2 (npm) CVE-2026-92956
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
Behoben in 3.11.7
-
kritisch 9,1 Paket-Ökosysteme
langflow (pip) CVE-2026-9205
Langflow: Weak Fernet Key via random.seed()
Behoben in 1.10.1
-
kritisch 9,8 Paket-Ökosysteme
langflow (pip) CVE-2026-8505
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
Behoben in 1.9.1
-
hoch 8,8 Paket-Ökosysteme
langflow (pip) CVE-2026-51886
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
Behoben in 1.10.1
-
hoch 8,8 Paket-Ökosysteme
langflow (pip) CVE-2026-7700
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution
Behoben in 1.10.3
-
hoch 7,5 Paket-Ökosysteme
probe-image-size (npm) CVE-2026-104861
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
Behoben in 7.4.0
-
hoch 7,5 Paket-Ökosysteme
@fastify/busboy (npm) CVE-2026-19481
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Behoben in 3.2.1
-
hoch 7,5 Paket-Ökosysteme
@fastify/busboy (npm) CVE-2026-19484
@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Behoben in 3.2.1
-
hoch 8,8 Paket-Ökosysteme
headroom-ai (pip) CVE-2026-71416
Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
Behoben in 0.35.0
-
kritisch 9,3 Paket-Ökosysteme
@a2ui/web_core (npm) CVE-2026-10032
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
Behoben in 0.10.2
-
kritisch 10,0 Paket-Ökosysteme
vibe-trading-ai (pip) GHSA-v2f8-6655-7grj
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
Behoben in 0.1.7
-
hoch 7,5 Paket-Ökosysteme
vibe-trading-ai (pip) GHSA-5rmq-chc7-m22f
Vibe-Trading file-read tools expose arbitrary server-readable files
Behoben in 0.1.7
-
kritisch 10,0 Paket-Ökosysteme
vibe-trading-ai (pip) GHSA-jqmf-mx4f-hfr6
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
Behoben in 0.1.7
-
hoch 7,7 Paket-Ökosysteme
trigger.dev (npm) GHSA-9q4r-4842-93vw
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
Behoben in 4.5.6
-
hoch 8,1 Paket-Ökosysteme
trigger.dev (npm) GHSA-pqxw-g93w-hj9x
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
Behoben in 4.5.6
-
hoch 8,2 Paket-Ökosysteme
figlet (npm) CVE-2026-96780
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
Behoben in 1.11.3
-
kritisch 9,2 Paket-Ökosysteme
trigger.dev (npm) GHSA-gg6r-gp4c-89hp
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
Behoben in 4.5.4
-
hoch 7,1 Paket-Ökosysteme
trigger.dev (npm) GHSA-pp95-gc86-jq6q
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
Behoben in 4.5.2
-
hoch 7,7 Paket-Ökosysteme
trigger.dev (npm) GHSA-xxv7-2vv3-h682
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
Behoben in 4.5.2
-
hoch 7,1 Paket-Ökosysteme
trigger.dev (npm) GHSA-qxpp-qjg8-x4jv
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Behoben in 4.5.2
-
hoch 8,8 Paket-Ökosysteme
dulwich (pip) GHSA-8mcx-5rqc-vhmf
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
Behoben in 1.2.9
-
hoch 8,6 Paket-Ökosysteme
dulwich (pip) GHSA-8w8g-wq8h-fq33
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
Behoben in 1.2.8
-
hoch 8,6 Paket-Ökosysteme
dulwich (pip) GHSA-5fqc-mrg8-w798
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
Behoben in 1.2.8
-
hoch 8,6 Paket-Ökosysteme
dulwich (pip) GHSA-cm62-gvxx-vmxx
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Behoben in 1.2.8
-
hoch 7,2 CMS und Shops
JetAppointment (WordPress-Plugin) CVE-2026-93875
The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output …
-
hoch 8,2 Paket-Ökosysteme
zod (npm) CVE-2023-54404
Zod can exhaust memory while validating oversized constrained collections
Behoben in 4.6.6
-
hoch 8,8 Webserver und Basis
Apache HTTP Server CVE-2026-93546
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via …
Behoben in 2.4.69
-
hoch 7,3 Webserver und Basis
Apache HTTP Server CVE-2026-73637
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest …
Behoben in 2.4.69
-
hoch 8,1 Webserver und Basis
Apache HTTP Server CVE-2026-73636
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication …
Behoben in 2.4.69
-
hoch 7,5 Webserver und Basis
Apache HTTP Server CVE-2026-63718
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding. This issue …
Behoben in 2.4.69
-
hoch 7,5 Webserver und Basis
Apache HTTP Server CVE-2026-63686
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a …
Behoben in 2.4.69
-
hoch 7,5 Webserver und Basis
Apache HTTP Server CVE-2026-63292
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code …
Behoben in 2.4.69
-
hoch 7,5 Webserver und Basis
Apache HTTP Server CVE-2026-63045
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause …
Behoben in 2.4.69
-
kritisch 9,8 Webserver und Basis
Apache HTTP Server CVE-2026-59797
Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Behoben in 2.4.69
-
hoch 7,5 Webserver und Basis
Apache HTTP Server CVE-2026-59685
Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Behoben in 2.4.69
-
kritisch 9,8 Webserver und Basis
Apache HTTP Server CVE-2026-57941
Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Behoben in 2.4.69
-
hoch 7,5 Webserver und Basis
Apache HTTP Server CVE-2026-56449
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68.
Behoben in 2.4.69
-
kritisch 9,8 Webserver und Basis
Apache HTTP Server CVE-2026-56154
Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Behoben in 2.4.69
-
hoch 7,5 Webserver und Basis
Apache HTTP Server CVE-2026-56153
Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Behoben in 2.4.69
-
hoch 7,5 Webserver und Basis
Apache HTTP Server CVE-2026-48005
Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced …
Behoben in 2.4.69
-
hoch 7,5 Webserver und Basis
Apache HTTP Server CVE-2026-47360
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be …
Behoben in 2.4.69
-
hoch 7,5 Webserver und Basis
Apache HTTP Server CVE-2026-46729
NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Behoben in 2.4.69
-
kritisch 9,9 Paket-Ökosysteme
vm2 (npm) CVE-2026-92948
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
Behoben in 3.11.7
-
hoch 8,6 Paket-Ökosysteme
vm2 (npm) CVE-2026-92950
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Behoben in 3.11.7
-
kritisch 10,0 Paket-Ökosysteme
vm2 (npm) CVE-2026-92940
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
Behoben in 3.11.7
-
kritisch 9,9 Paket-Ökosysteme
vm2 (npm) CVE-2026-92951
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
Behoben in 3.11.7
-
hoch 8,5 Paket-Ökosysteme
vm2 (npm) CVE-2026-92958
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
Behoben in 3.11.7
-
kritisch 9,9 Paket-Ökosysteme
vm2 (npm) CVE-2026-92957
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
Behoben in 3.11.7
-
kritisch 9,0 Paket-Ökosysteme
vm2 (npm) CVE-2026-92935
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
Behoben in 3.11.7
-
kritisch 10,0 Paket-Ökosysteme
vm2 (npm) CVE-2026-92937
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
Behoben in 3.11.7
-
kritisch 9,9 Paket-Ökosysteme
vm2 (npm) CVE-2026-92938
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
Behoben in 3.11.7
-
kritisch 9,9 Paket-Ökosysteme
vm2 (npm) CVE-2026-92939
vm2 crypto builtin loads attacker native code through setEngine
Behoben in 3.11.7
-
kritisch 9,8 Paket-Ökosysteme
vm2 (npm) CVE-2026-92944
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
Behoben in 3.11.7
-
kritisch 10,0 Paket-Ökosysteme
vm2 (npm) CVE-2026-92941
vm2 NodeVM can replace the host process TLS trust store
Behoben in 3.11.7
-
hoch 8,1 Paket-Ökosysteme
jupyterlab, notebook, jupyterlite +1 (pip) CVE-2026-102831
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
Behoben in 4.6.4, 4.5.11, 7.6.3, 0.8.4
-
hoch 7,5 Paket-Ökosysteme
devalue (npm) CVE-2026-92708
devalue: `stringify`/`uneval` serialize shared memory
Behoben in 5.9.3
-
hoch 8,2 Paket-Ökosysteme
devalue (npm) GHSA-mcm9-63f2-9j32
devalue: Repeated primitive strings cause quadratic expansion in uneval
Behoben in 5.9.3
-
hoch 8,2 Paket-Ökosysteme
devalue (npm) GHSA-r9w8-h9r3-54w4
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
Behoben in 5.9.3
-
hoch 8,2 Paket-Ökosysteme
devalue (npm) GHSA-x5rw-q4pp-hg5g
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
Behoben in 5.9.3
-
hoch 7,8 Paket-Ökosysteme
virtualenv (pip) CVE-2026-102925
virtualenv bash and fish activation scripts execute commands embedded in paths
Behoben in 21.7.13
-
hoch 7,3 Paket-Ökosysteme
virtualenv (pip) CVE-2026-102937
virtualenv: Command injection via --prompt in activate.bat (batch activator)
Behoben in 21.7.12
-
hoch 8,7 Paket-Ökosysteme
pypdf (pip) CVE-2026-102999
pypdf: Possible long runtimes with large amount of embedded files
Behoben in 6.19.0
-
hoch 8,7 Paket-Ökosysteme
pypdf (pip) CVE-2026-102998
pypdf: Possible long runtimes when generating appearance streams
Behoben in 6.19.0
-
hoch 8,7 Paket-Ökosysteme
pypdf (pip) CVE-2026-103000
pypdf: Possible large memory usage when retrieving alphabetical page labels
Behoben in 6.19.0
-
hoch 8,7 Paket-Ökosysteme
pypdf (pip) CVE-2026-102997
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
Behoben in 6.18.1
-
hoch 8,7 Paket-Ökosysteme
pypdf (pip) CVE-2026-102996
pypdf: Possible large memory usage when parsing font data
Behoben in 6.18.1
-
hoch 8,7 Paket-Ökosysteme
pypdf (pip) CVE-2026-102995
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
Behoben in 6.18.1
-
hoch 8,7 Paket-Ökosysteme
pypdf (pip) CVE-2026-102994
pypdf: Possible long runtimes/large memory usage when parsing indirect objects
Behoben in 6.18.0
-
hoch 8,7 Paket-Ökosysteme
pypdf (pip) CVE-2026-102993
pypdf: Possible large memory usage when retrieving Roman page labels
Behoben in 6.17.0
-
kritisch 9,2 Paket-Ökosysteme
piscina (npm) CVE-2026-102992
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
Behoben in 5.3.2, 4.9.4, 6.0.0-rc.5
-
hoch 8,2 Paket-Ökosysteme
basic-ftp (npm) CVE-2026-102990
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
Behoben in 6.2.1
-
hoch 7,7 Paket-Ökosysteme
virtualenv (pip) CVE-2026-102930
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
Behoben in 21.7.12
-
hoch 7,5 Paket-Ökosysteme
tornado (pip) GHSA-chx6-46f5-w4vp
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
Behoben in 6.5.9
-
hoch 8,2 Paket-Ökosysteme
tornado (pip) GHSA-c2m8-h5v5-343r
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
Behoben in 6.5.9
-
hoch 8,1 Paket-Ökosysteme
fastify (npm) CVE-2026-84504
fastify vulnerable to request body replacement via an async validation result collision
Behoben in 5.12.2
-
hoch 7,5 Paket-Ökosysteme
fastify (npm) CVE-2026-76169
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
Behoben in 5.12.2
-
hoch 7,5 Paket-Ökosysteme
fastify (npm) CVE-2026-84469
fastify vulnerable to request validation bypass via skipped boolean false schemas
Behoben in 5.12.2
-
hoch 7,5 Paket-Ökosysteme
fastify (npm) CVE-2026-84428
fastify vulnerable to header validation bypass via incomplete schema case normalization
Behoben in 5.12.2
-
hoch 8,2 Paket-Ökosysteme
@astrojs/node (npm) CVE-2026-102984
Astro: Malformed port in the Host header can crash the Node adapter
Behoben in 11.1.3
-
hoch 7,5 Paket-Ökosysteme
GitPython (pip) CVE-2026-87819
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
Behoben in 3.1.60
-
hoch 8,8 Paket-Ökosysteme
gitpython (pip) CVE-2026-87817
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
Behoben in 3.1.60
-
hoch 8,2 Paket-Ökosysteme
@angular/router (npm) CVE-2026-101896
Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters
Behoben in 22.2.0, 21.2.24, 20.3.32
-
hoch 7,5 Paket-Ökosysteme
league/commonmark (Composer) GHSA-3q6v-r5mr-hxv8
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Behoben in 2.10.2
-
hoch 7,4 Paket-Ökosysteme
@grpc/grpc-js (npm) CVE-2026-101916
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
Behoben in 1.13.6, 1.14.5
-
hoch 7,6 Paket-Ökosysteme
axios (npm) CVE-2026-101905
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Behoben in 1.20.0
-
hoch 7,0 Paket-Ökosysteme
axios (npm) CVE-2026-101907
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Behoben in 1.20.0
-
hoch 8,2 Paket-Ökosysteme
axios (npm) CVE-2026-101903
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
Behoben in 1.20.0
-
hoch 8,2 Paket-Ökosysteme
axios (npm) CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
Behoben in 1.20.0
-
hoch 8,3 Paket-Ökosysteme
axios (npm) CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Options
Behoben in 0.34.0, 1.20.0
-
hoch 7,0 Paket-Ökosysteme
axios (npm) CVE-2026-101898
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Behoben in 1.20.0
-
hoch 8,2 Paket-Ökosysteme
axios (npm) CVE-2026-101901
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Behoben in 1.20.0
-
kritisch 9,5 Paket-Ökosysteme
next (npm) GHSA-vcvr-r3jv-pc5j
Next.js: Remote Code Execution in next/og ImageResponse
Behoben in 16.3.6
-
hoch 8,9 Paket-Ökosysteme
urllib3 (pip) CVE-2026-97689
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
Behoben in 2.8.0
-
hoch 7,6 Paket-Ökosysteme
urllib3 (pip) CVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
Behoben in 2.8.0
-
hoch 7,4 Paket-Ökosysteme
@nestjs/platform-fastify (npm) GHSA-9c5c-9qcx-q35q
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
Behoben in 11.2.4, 12.0.2
-
hoch 7,5 Paket-Ökosysteme
nodemailer (npm) CVE-2026-90776
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
Behoben in 10.0.5
-
hoch 7,5 Paket-Ökosysteme
@nestjs/microservices (npm) CVE-2026-102281
Nest: Remote process termination via a deeply nested microservice message pattern
Behoben in 11.2.4, 12.0.2
-
kritisch 9,1 Paket-Ökosysteme
@xhmikosr/decompress, decompress (npm) CVE-2026-101894
@xhmikosr/decompress: Path traversal via symlink chain
Behoben in 11.1.4, 10.2.2
-
hoch 7,5 Paket-Ökosysteme
brace-expansion (npm) CVE-2026-102278
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
Behoben in 5.0.11, 3.0.8, 2.1.6, 1.1.20
-
hoch 7,5 Paket-Ökosysteme
brace-expansion (npm) CVE-2026-102276
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
Behoben in 5.0.10, 3.0.7, 2.1.5, 1.1.19
-
hoch 7,5 Paket-Ökosysteme
engine.io (npm) CVE-2026-102599
Socket.IO: Engine.IO Protocol Revision Mismatch DoS
Behoben in 6.6.10
-
hoch 7,5 Paket-Ökosysteme
nodemailer (npm) GHSA-v53p-9fqp-m79j
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
Behoben in 10.0.6
-
hoch 7,4 Paket-Ökosysteme
PyJWT (pip) CVE-2026-102266
PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
Behoben in 2.14.0
-
kritisch 9,1 Paket-Ökosysteme
PyJWT (pip) CVE-2026-102268
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
Behoben in 2.14.0
-
hoch 7,4 Paket-Ökosysteme
PyJWT (pip) CVE-2026-102273
PyJWT accepts public JWK containers as HMAC secrets
Behoben in 2.14.0
-
hoch 7,4 Paket-Ökosysteme
PyJWT (pip) CVE-2026-102267
PyJWT: PyJWKClient follows redirects when fetching JWKS
Behoben in 2.14.0
-
hoch 7,4 Paket-Ökosysteme
pyjwt (pip) CVE-2026-102271
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
Behoben in 2.14.0
-
hoch 7,4 Paket-Ökosysteme
PyJWT (pip) CVE-2026-102272
PyJWT BOM Bypass
Behoben in 2.14.0
-
hoch 7,5 Paket-Ökosysteme
adm-zip (npm) GHSA-8238-w5pm-2374
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
Behoben in 0.6.1
-
hoch 7,5 Paket-Ökosysteme
adm-zip (npm) GHSA-rcw4-f5rp-g42v
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0
Behoben in 0.6.1
-
hoch 7,1 Paket-Ökosysteme
adm-zip (npm) CVE-2026-102282
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
Behoben in 0.6.1
-
hoch 7,5 Paket-Ökosysteme
undici (npm) CVE-2026-19534
undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
Behoben in 6.28.1, 7.29.1, 8.10.2
-
hoch 7,4 Paket-Ökosysteme
undici (npm) CVE-2026-84961
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
Behoben in 7.29.1, 8.10.2
-
hoch 7,4 Paket-Ökosysteme
undici (npm) CVE-2026-85152
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
Behoben in 8.10.2
-
hoch 8,7 Paket-Ökosysteme
joi (npm) CVE-2026-92599
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
Behoben in 17.13.7, 18.2.6
-
hoch 8,2 Paket-Ökosysteme
electron (npm) CVE-2026-102673
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab
Behoben in 41.10.4, 42.5.2, 43.0.0
-
hoch 8,2 Paket-Ökosysteme
electron (npm) CVE-2026-102674
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions
Behoben in 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
-
hoch 7,4 Paket-Ökosysteme
electron (npm) CVE-2026-102675
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
Behoben in 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
-
hoch 8,3 Paket-Ökosysteme
electron (npm) CVE-2026-102676
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
Behoben in 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5
-
hoch 7,8 Paket-Ökosysteme
electron (npm) CVE-2026-102677
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
Behoben in 42.10.0, 43.5.0, 44.0.0-beta.6
-
hoch 8,6 Paket-Ökosysteme
phpcsstandards/phpcsutils (Composer) CVE-2026-65954
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()
Behoben in 1.2.3
-
hoch 7,1 CMS und Shops
Joomla CVE-2026-92232
Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected …
Behoben in 5.4.8, 6.1.3
-
hoch 7,1 CMS und Shops
Joomla CVE-2026-92231
Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against …
Behoben in 5.4.8, 6.1.3
-
hoch 8,2 CMS und Shops
Joomla CVE-2026-92227
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.
Behoben in 5.4.8, 6.1.3
-
hoch 7,0 CMS und Shops
Joomla CVE-2026-92226
Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform edit actions on otherwise …
Behoben in 5.4.8, 6.1.3
-
hoch 8,9 CMS und Shops
Joomla CVE-2026-92222
Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading to SSRF vectors.
Behoben in 5.4.8, 6.1.3
-
hoch 7,0 CMS und Shops
Joomla CVE-2026-90915
Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the …
Behoben in 5.4.8, 6.1.3
-
hoch 7,0 CMS und Shops
Joomla CVE-2026-90913
Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check allows unauthorized users to perform mutation actions in access …
Behoben in 5.4.8, 6.1.3
-
hoch 7,4 Paket-Ökosysteme
webpack-dev-middleware (npm) CVE-2026-76844
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
Behoben in 8.3.0, 7.4.6
-
hoch 7,5 Webserver und Basis
OpenSSL CVE-2026-84784
Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC …
Behoben in 3.4.8, 3.5.9, 3.6.5, 4.0.3
-
hoch 7,5 Webserver und Basis
OpenSSL CVE-2026-84783
Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated …
Behoben in 4.0.3
-
hoch 8,2 Webserver und Basis
OpenSSL CVE-2026-84782
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission …
Behoben in 1.0.2zs, 1.1.1zj, 3.0.23, 3.4.8, 3.5.9, 3.6.5
-
hoch 7,5 Webserver und Basis
OpenSSL CVE-2026-72897
Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows …
Behoben in 3.4.8, 3.5.9, 3.6.5, 4.0.3
-
hoch 7,5 Webserver und Basis
OpenSSL CVE-2026-54873
Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit this vulnerability by sending maliciously crafted packets, making the …
Behoben in 3.4.8, 3.5.9, 3.6.5, 4.0.3
-
hoch 8,7 Paket-Ökosysteme
@angular/platform-server (npm) CVE-2026-101895
Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
Behoben in 22.1.6, 21.2.23, 20.3.31
-
hoch 7,5 Paket-Ökosysteme
fast-uri (npm) CVE-2026-84292
fast-uri vulnerable to authority injection via an unvalidated port in serialize
Behoben in 2.4.6, 3.1.7, 4.1.4
-
hoch 7,5 Paket-Ökosysteme
fast-uri (npm) CVE-2026-84394
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
Behoben in 2.4.6, 3.1.7, 4.1.4
-
hoch 8,6 Paket-Ökosysteme
@angular/platform-server (npm) CVE-2026-88058
Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
Behoben in 22.1.4, 21.2.22, 20.3.30
-
hoch 7,8 Paket-Ökosysteme
code-ollama (npm) GHSA-456v-xq2p-r4cj
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
Behoben in 0.36.1
-
hoch 7,5 Paket-Ökosysteme
scbe-aethermoore (pip) CVE-2026-57443
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
Behoben in 4.2.1
-
hoch 8,4 Paket-Ökosysteme
CliInvoke.Specializations, AlastairLundy.CliInvoke.Specializations (NuGet) CVE-2026-100368
CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers
Behoben in 2.8.5, 2.9.4, 2.10.5, 3.0.0-beta.1, 2.0.2
-
hoch 8,4 Paket-Ökosysteme
CliInvoke, AlastairLundy.CliInvoke (NuGet) CVE-2026-100369
CliInvoke: Argument Injection in Extensibility Runner Factory
Behoben in 2.8.5, 2.9.4, 2.10.5, 3.0.0-beta.2, 2.0.2
-
hoch 8,7 Paket-Ökosysteme
khoj (pip) GHSA-62mm-xwmv-crhg
khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem
Behoben in 2.0.0-beta.25
-
hoch 7,5 Laufzeiten und Kerne
PHP CVE-2026-91765
cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer …
Behoben in 8.2.34, 8.3.35, 8.4.26, 8.5.11
-
hoch 8,8 Paket-Ökosysteme
knowns (npm) CVE-2026-86439
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
Behoben in 0.30.0
-
hoch 7,1 Paket-Ökosysteme
@openzeppelin/confidential-contracts (npm) GHSA-29h2-jr22-frmh
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
Behoben in 0.3.2, 0.4.2, 0.5.2
-
kritisch 9,8 Paket-Ökosysteme
fof/oauth (Composer) CVE-2026-92161
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
Behoben in 1.7.4, 2.0.0-beta.4
-
hoch 7,5 Paket-Ökosysteme
starcitizenwiki/embedvideo (Composer) CVE-2026-57440
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
Behoben in 4.1.0
-
hoch 7,3 Paket-Ökosysteme
code16/sharp (Composer) CVE-2026-61823
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
Behoben in 9.22.5
-
hoch 8,7 Paket-Ökosysteme
code16/sharp (Composer) CVE-2026-61825
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
Behoben in 9.22.5
Die Beschreibungen stammen aus den Quellen und sind auf Englisch.
Welche Versionen noch Updates bekommen
Für eine Version ohne Updates werden neue Lücken nicht mehr geschlossen. Dann hilft nur der Wechsel auf einen neueren Zweig.
PHP
| Zweig | Neueste | Status |
|---|---|---|
| 8.5 | 8.5.12 | bekommt Updates bis 31.12.2029 |
| 8.4 | 8.4.27 | bekommt Updates bis 31.12.2028 |
| 8.3 | 8.3.36 | bekommt Updates bis 31.12.2027 |
| 8.2 | 8.2.35 | Updates enden bald bis 31.12.2026 |
| 8.1 | 8.1.34 | keine Updates mehr |
Node.js
| Zweig | Neueste | Status |
|---|---|---|
| 26 | 26.12.1 | bekommt Updates bis 30.04.2029 |
| 25 | 25.9.0 | keine Updates mehr |
| 24 | 24.22.1 | bekommt Updates bis 30.04.2028 |
| 23 | 23.11.1 | keine Updates mehr |
| 22 | 22.23.4 | bekommt Updates bis 30.04.2027 |
WordPress
| Zweig | Neueste | Status |
|---|---|---|
| 7.1 | 7.1.3 | bekommt Updates |
| 7.0 | 7.0.7 | bekommt Updates |
| 6.9 | 6.9.10 | bekommt Updates |
| 6.8 | 6.8.11 | bekommt Updates |
| 6.7 | 6.7.10 | bekommt Updates |
.NET
| Zweig | Neueste | Status |
|---|---|---|
| 10 | 10.0.13 | bekommt Updates bis 14.11.2028 |
| 9 | 9.0.21 | Updates enden bald bis 10.11.2026 |
| 8 | 8.0.32 | Updates enden bald bis 10.11.2026 |
| 7 | 7.0.20 | keine Updates mehr |
| 6 | 6.0.36 | keine Updates mehr |
Python
| Zweig | Neueste | Status |
|---|---|---|
| 3.15 | 3.15.1 | bekommt Updates bis 31.10.2031 |
| 3.14 | 3.14.9 | bekommt Updates bis 31.10.2030 |
| 3.13 | 3.13.17 | bekommt Updates bis 31.10.2029 |
| 3.12 | 3.12.15 | bekommt Updates bis 31.10.2028 |
| 3.11 | 3.11.17 | bekommt Updates bis 31.10.2027 |
Meldungen des BSI
Warnungen des Bundesamts für Sicherheit in der Informationstechnik zu den Produkten oben, Stufe hoch und kritisch.
- kritisch PHP: Mehrere Schwachstellen ermöglichen Codeausführung aktualisiert
- hoch Apache HTTP Server: Mehrere Schwachstellen aktualisiert
- hoch Apache HTTP Server: Mehrere Schwachstellen aktualisiert
- hoch Apache HTTP Server: Mehrere Schwachstellen aktualisiert
- hoch Apache HTTP Server: Mehrere Schwachstellen aktualisiert
- hoch Red Hat Enterprise Linux (python-tornado, resteasy-core, bubblewrap, pgvector): Mehrere Schwachstellen aktualisiert
- hoch Apache HTTP Server: Mehrere Schwachstellen aktualisiert
- hoch OpenSSL: Mehrere Schwachstellen aktualisiert
- hoch OpenSSL: Mehrere Schwachstellen aktualisiert
- hoch PHP: Mehrere Schwachstellen aktualisiert
- hoch cURL: Mehrere Schwachstellen aktualisiert
- hoch PHP: Mehrere Schwachstellen aktualisiert
- hoch PHP: Mehrere Schwachstellen aktualisiert
- hoch PHP: Mehrere Schwachstellen aktualisiert
- kritisch PHP: Mehrere Schwachstellen aktualisiert
- hoch PHP: Mehrere Schwachstellen aktualisiert
- hoch PHP: Mehrere Schwachstellen aktualisiert
- hoch PHP: Mehrere Schwachstellen aktualisiert
- hoch PHP: Mehrere Schwachstellen aktualisiert
- hoch PHP: Mehrere Schwachstellen aktualisiert
- hoch PHP: Mehrere Schwachstellen ermöglichen Codeausführung aktualisiert
- hoch NGINX: Mehrere Schwachstellen aktualisiert
Was tun, wenn deine Website betroffen ist?
Meist reicht ein Update. Wie du bei PHP und Node.js prüfst, welche Version läuft, und das Update selbst einspielst, steht Schritt für Schritt in der Anleitung zu PHP2Shell und den Node.js-Lücken.
Wenn du unsicher bist, ob deine Seite betroffen ist, oder es dir zu technisch wird, schreib mir.
Quellen
- NVD (National Vulnerability Database) abgerufen am 25. Oktober 2026, 01:25 Uhr
- GitHub Advisory Database abgerufen am 25. Oktober 2026, 01:24 Uhr
- CISA-Katalog aktiv ausgenutzter Lücken abgerufen am 25. Oktober 2026, 01:24 Uhr
- BSI Warn- und Informationsdienst abgerufen am 25. Oktober 2026, 01:24 Uhr
- endoflife.date abgerufen am 25. Oktober 2026, 01:24 Uhr
Neue CVEs erscheinen hier, sobald NVD sie einem Produkt zugeordnet hat. Das dauert meist Stunden, manchmal einige Tage. Lücken in Paketen (npm, Composer, NuGet, pip, GitHub Actions) kommen direkt aus der GitHub Advisory Database und sind oft schneller da.
Die Seite wird automatisch erstellt. Ich prüfe die Einträge nicht einzeln, deshalb ohne Gewähr.