The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to...

CVE-2026-13331

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection

历史摘要 · 未重新核验 · GitHub Advisory

The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to...

CVE-2026-13422

The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API

### Summary The `GET /api/v1/ddns` and `GET /api/v1/notification` endpoints return full resource objects including plai

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Reserved bin name deletes PNPM_HOME during global remove

CVE-2026-55699

Maintainer Action Plan ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start w

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

CVE-2026-55180

## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec

历史摘要 · 未重新核验 · GitHub Advisory

ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame image

CVE-2026-53465

An crafted multi-frame can result in a heap buffer over-write when encoding it with the SF3 encoder.

历史摘要 · 未重新核验 · GitHub Advisory

ImageMagick: Memory Leak in wand option parser when providing invalid arguments

CVE-2026-53464

When providing invalid options to the wand option parser a small memory leak will occur.

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

CVE-2026-53523

## 1. Description The `getRedirectURL` function in `oauth2.go:22-29` constructs the OAuth2 callback URL by concatenatin

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS

CVE-2026-53522

## 1. Description The Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agent

历史摘要 · 未重新核验 · GitHub Advisory

Statamic Vulnerable to CSV formula injection in form submission exports

CVE-2026-54243

### Impact Form submission values were not neutralized for spreadsheet formula characters when exported to CSV. A submi

历史摘要 · 未重新核验 · GitHub Advisory

Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)

CVE-2026-54242

### Impact The Glide image proxy's URL validation could be bypassed using DNS rebinding. The remote hostname was valida

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

CVE-2026-53521

## Summary `PATCH /server/{id}` accepts and persists nonexistent `ddns_profiles` IDs for a member-owned server. If anot

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

CVE-2026-53520

### Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose `domain` is equ

历史摘要 · 未重新核验 · GitHub Advisory

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

CVE-2026-50017

## Summary pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

CVE-2026-50014

## Summary pnpm passes the lockfile-controlled git `resolution.commit` value to `git fetch` without a `--` separator or

历史摘要 · 未重新核验 · GitHub Advisory

pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field

CVE-2026-50021

## Summary pnpm's tarball extraction worker skips integrity verification when the `integrity` field is absent from the

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Unsafe default behavior breaks integrity check

CVE-2026-50573

While it is unclear whether this should be classified as a vulnerability, it is being reported through this channel beca

历史摘要 · 未重新核验 · GitHub Advisory

js-toml has silent type confusion via falsy-primitive duplicate-key bypass

CVE-2026-50029

### Summary `js-toml`'s interpreter checks whether a key already exists in a parser-built container with `if (object[ke

历史摘要 · 未重新核验 · GitHub Advisory

regclient may leak authentication credentials to external blob stores

CVE-2026-49349

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a maliciou

历史摘要 · 未重新核验 · GitHub Advisory

YARD static cache reads raw traversal paths before router sanitization

CVE-2026-49342

### Summary YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is conf

历史摘要 · 未重新核验 · GitHub Advisory