Current research.

CVEs and security advisories from my research into well-known software. Each record carries its CVSS score (v4.0 or v3.1) as published in the CVE record or the GitHub advisory, plus its weakness class (CWE), the affected product and the publication date.

>_

SORTNewest firstOldest firstCVSS · high to lowCVSS · low to high

CardsTable

FILTER BY THREAT LEVEL

All47Critical10High16Medium18Low3

Showing 1–9 of 47

NxNrwl · >= 21.4.0, < 22.7.8 +1

High

CVE-2026-104859

OS command injection in the @nx/docker release pipeline

CVSS 4.0

7.3

CWE

CWE-78

Published

2026-10-02

↗

NxNrwl · >= 13.10.0, < 22.7.10 +1

Medium

CVE-2026-104853

Path traversal in nx migrate package-migrations extraction

CVSS 4.0

5.8

CWE

CWE-22

Published

2026-10-02

↗

Joomla! CMSJoomla! · >= 4.0.0, <= 5.4.8 +1

Medium

CVE-2026-90916

Improper ACL checks in content history comparison view

CVSS 4.0

5.1

CWE

CWE-284

Published

2026-09-29

↗

frpfatedier · >= 0.53.0, < 0.70.1

High

CVE-2026-73564

Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

CVSS 4.0

8.7

CWE

CWE-129

Published

2026-08-13

↗

pRESTpREST · <= 2.4.0

High

CVE-2026-110788

SQL Injection via Unquoted Template Interpolation in _QUERIES Scripts

CVSS 3.1

8.6

CWE

CWE-89

Published

2026-07-29

↗

pRESTpREST · <= 2.2.0

High

CVE-2026-104104

Unauthenticated SQL Injection in Custom Query Templates via Unsanitized Request Headers

CVSS 3.1

8.1

CWE

CWE-89

Published

2026-07-27

↗

OpenCanaryThinkst · 0.9.8

Medium

CVE-2026-16551

Denial-of-Service in MongoDB module

CVSS 4.0

6.9

CWE

CWE-835

Published

2026-07-22

↗

pRESTpREST · <= 2.2.0

Critical

CVE-2026-104131

Unauthenticated SQL Injection via the _select Projection Parameter

CVSS 3.1

9.8

CWE

CWE-89

Published

2026-07-22

↗

AVideoWWBN · <= 29.0

Critical

CVE-2026-54458

Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

CVSS 3.1

9.6

CWE

CWE-79

Published

2026-07-15

↗