CVE ID :CVE-2026-118660 Published : Oct. 28, 2026, 9:16 p.m. | 34 minutes ago Description :Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link…
CVE ID :CVE-2026-118664 Published : Oct. 28, 2026, 9:16 p.m. | 34 minutes ago Description :decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects…
CVE ID :CVE-2026-118665 Published : Oct. 28, 2026, 9:16 p.m. | 34 minutes ago Description :GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages…
CVE ID :CVE-2026-78674 Published : Oct. 28, 2026, 7:21 p.m. | 29 minutes ago Description :The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary…
CVE ID :CVE-2025-14260 Published : Oct. 28, 2026, 7:21 p.m. | 29 minutes ago Description :Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can…
CVE ID :CVE-2026-109411 Published : Oct. 28, 2026, 7:17 p.m. | 33 minutes ago Description :An access control bypass flaw was found in Samba’s vfs_ceph_rgw module in it’s openat() function. An authenticated user can bypass access controls to read or overwrite…
CVE ID :CVE-2026-118687 Published : Oct. 28, 2026, 7:17 p.m. | 33 minutes ago Description :Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs…
CVE ID :CVE-2026-118688 Published : Oct. 28, 2026, 7:17 p.m. | 33 minutes ago Description :wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD…
CVE ID :CVE-2026-116688 Published : Oct. 27, 2026, 8:17 p.m. | 13 minutes ago Description :CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose…
CVE ID :CVE-2026-112355 Published : Oct. 27, 2026, 8:17 p.m. | 13 minutes ago Description :The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because…