FLAT-MV4U1 (MAL-2026-17647)
Use of software with malware In function-color
5.2
Medium
Ecosystem: Npm
Component: function-color
FLAT-QAB0G (MAL-2026-17648)
Use of software with malware In function-flag
5.2
Medium
Ecosystem: Npm
Component: function-flag
FLAT-ZOZYX (CVE-2026-61439)
OS Command Injection In praisonai
6.9
Medium
Ecosystem: PyPI
Component: praisonai
FLAT-9XWQI (CVE-2026-105642)
Server side template injection In ghost
5.9
Medium
Ecosystem: Npm
Component: ghost
FLAT-Y4BHX (CVE-2026-105643)
Server side cross-site scripting In ghost
4.1
Medium
Ecosystem: Npm
Component: ghost
FLAT-LR16M (CVE-2026-105644)
Server side cross-site scripting In ghost
4.5
Medium
Ecosystem: Npm
Component: ghost
FLAT-F6CE8 (CVE-2026-105645)
Asymmetric denial of service - ReDoS In ghost
4.6
Medium
Ecosystem: Npm
Component: ghost
FLAT-SMRJJ (CVE-2026-105646)
Asymmetric denial of service - ReDoS In ghost
2.1
Low
Ecosystem: Npm
Component: ghost
FLAT-UX8AN (CVE-2026-106121)
Improper resource allocation In com.rabbitmq:amqp-client
4.6
Medium
Ecosystem: Maven
Component: com.rabbitmq:amqp-client
FLAT-8HJYE (CVE-2026-105742)
Technical information leak In docling
4.6
Medium
Ecosystem: PyPI
Component: docling
FLAT-32SR5 (CVE-2026-105743)
Server-side request forgery (SSRF) In docling-slim
6.6
Medium
Ecosystem: PyPI
Component: docling-slim
FLAT-UWBUU (CVE-2026-105744)
Lack of data validation - Path Traversal In docling
7.1
High
Ecosystem: PyPI
Component: docling
FLAT-05QY7 (CVE-2026-105748)
Lack of data validation - Path Traversal In docling
1.7
Low
Ecosystem: PyPI
Component: docling
FLAT-AOBX8 (CVE-2026-105749)
Asymmetric denial of service In docling-slim
6.6
Medium
Ecosystem: PyPI
Component: docling-slim
FLAT-3YIOQ (CVE-2026-105745)
Dependency Confusion In docling-slim
4.4
Medium
Ecosystem: PyPI
Component: docling-slim
FLAT-WL3VO (CVE-2026-105697)
OS Command Injection In lfx
8.4
High
Ecosystem: PyPI
Component: lfx
FLAT-DFPJ0 (CVE-2026-105698)
Improper authorization control for web services In langflow
0.6
Low
Ecosystem: PyPI
Component: langflow
FLAT-J4D4H (CVE-2026-106451)
Insecure temporary files In org.lz4:lz4-java
4.4
Medium
Ecosystem: Maven
Component: org.lz4:lz4-java
FLAT-9IQF2 (CVE-2026-106449)
Improper resource allocation In at.yawk.lz4:lz4-java
1.7
Low
Ecosystem: Maven
Component: at.yawk.lz4:lz4-java
FLAT-3A0I4 (CVE-2026-106450)
Improper resource allocation In org.lz4:lz4-java
6.6
Medium
Ecosystem: Maven
Component: org.lz4:lz4-java
FLAT-KCSSS (CVE-2026-105647)
Server-side request forgery (SSRF) In ghost
2.7
Low
Ecosystem: Npm
Component: ghost
FLAT-2BT4V (CVE-2026-105648)
Lack of data validation In ghost
1.7
Low
Ecosystem: Npm
Component: ghost
FLAT-K4BVA (CVE-2026-105649)
Server side cross-site scripting In ghost
4.5
Medium
Ecosystem: Npm
Component: ghost
FLAT-LHQ4E (CVE-2026-105699)
Improper authorization control for web services In langflow
4.9
Medium
Ecosystem: PyPI
Component: langflow
FLAT-TVVXK (CVE-2026-94544)
Business information leak In next
1.7
Low
Ecosystem: Npm
Component: next
FLAT-PPOSG (CVE-2026-94543)
Clickjacking In next
1.7
Low
Ecosystem: Npm
Component: next
FLAT-GPKB1 (CVE-2026-94486)
Cross-site request forgery In next
0.6
Low
Ecosystem: Npm
Component: next
FLAT-YZXNX (CVE-2026-94485)
Cross-site request forgery In next
1.7
Low
Ecosystem: Npm
Component: next
FLAT-WW1IX (CVE-2026-94484)
Cross-site request forgery In next
1.7
Low
Ecosystem: Npm
Component: next
FLAT-XJK7B (CVE-2026-94483)
Server-side request forgery (SSRF) In next
4.8
Medium
Ecosystem: Npm
Component: next
FLAT-UYAU3 (CVE-2026-105856)
SQL injection In @payloadcms/db-d1-sqlite
6.2
Medium
Ecosystem: Npm
Component: @payloadcms/db-d1-sqlite
FLAT-WYJ8O (CVE-2026-105858)
Remote command execution In payload
7.2
High
Ecosystem: Npm
Component: payload
FLAT-NAZTT (CVE-2026-105860)
Improper authorization control for web services In @payloadcms/plugin-multi-tenant
4.9
Medium
Ecosystem: Npm
Component: @payloadcms/plugin-multi-tenant
FLAT-G2CUR (CVE-2026-105861)
Sensitive information sent insecurely In payload
4.1
Medium
Ecosystem: Npm
Component: payload
FLAT-BMWK5 (CVE-2026-105862)
Insecure file upload In payload
5.7
Medium
Ecosystem: Npm
Component: payload
FLAT-97XJT (CVE-2026-105864)
Improper authorization control for web services In @payloadcms/plugin-multi-tenant
1.3
Low
Ecosystem: Npm
Component: @payloadcms/plugin-multi-tenant
FLAT-60WLP (CVE-2026-105865)
Lack of data validation - Path Traversal In payload
2.4
Low
Ecosystem: Npm
Component: payload
FLAT-O2XDR (CVE-2026-105866)
Account lockout In payload
2.7
Low
Ecosystem: Npm
Component: payload
FLAT-Z1RP4 (CVE-2026-105867)
Improper authorization control for web services In @payloadcms/storage-s3
5.0
Medium
Ecosystem: Npm
Component: @payloadcms/storage-s3
FLAT-A6Q1H (CVE-2026-105868)
Insecure file upload In payload
6.1
Medium
Ecosystem: Npm
Component: payload
FLAT-JZ6GH (CVE-2026-105857)
Server side template injection In @payloadcms/plugin-form-builder
9.1
Critical
Ecosystem: Npm
Component: @payloadcms/plugin-form-builder
FLAT-3KMTZ (CVE-2026-105859)
Improper authorization control for web services In payload
8.0
High
Ecosystem: Npm
Component: payload
FLAT-G0P8U (CVE-2026-105863)
Spoofing In payload
7.2
High
Ecosystem: Npm
Component: payload
FLAT-9ILMF (CVE-2026-104414)
Server side cross-site scripting In ghost
6.2
Medium
Ecosystem: Npm
Component: ghost
FLAT-963L1 (CVE-2026-105650)
Server side cross-site scripting In ghost
6.2
Medium
Ecosystem: Npm
Component: ghost
FLAT-VM3JE (CVE-2026-105651)
Server side cross-site scripting In ghost
6.0
Medium
Ecosystem: Npm
Component: ghost
FLAT-M6QEZ (CVE-2026-104413)
Server side cross-site scripting In ghost
6.0
Medium
Ecosystem: Npm
Component: ghost
FLAT-ZU0UG (CVE-2026-104415)
User enumeration In ghost
1.3
Low
Ecosystem: Npm
Component: ghost
FLAT-XANQP (CVE-2026-105652)
User enumeration In ghost
1.3
Low
Ecosystem: Npm
Component: ghost
FLAT-LOOO4 (CVE-2026-104416)
User enumeration In ghost
4.9
Medium
Ecosystem: Npm
Component: ghost
FLAT-9A44V (CVE-2026-105675)
User enumeration In ghost
6.2
Medium
Ecosystem: Npm
Component: ghost
FLAT-QK5HG (CVE-2026-104417)
Lack of data validation - Path Traversal In ghost
4.6
Medium
Ecosystem: Npm
Component: ghost
FLAT-6UQJG (CVE-2026-105676)
Lack of data validation - Path Traversal In ghost
4.6
Medium
Ecosystem: Npm
Component: ghost
FLAT-BW5A7 (CVE-2026-104418)
Server side template injection In ghost
6.1
Medium
Ecosystem: Npm
Component: ghost
FLAT-PCRJI (CVE-2026-105677)
Server side template injection In ghost
4.8
Medium
Ecosystem: Npm
Component: ghost
FLAT-47NE3 (CVE-2026-104412)
Excessive privileges In ghost
0.6
Low
Ecosystem: Npm
Component: ghost
FLAT-NHL2V (CVE-2026-105678)
Excessive privileges In ghost
0.6
Low
Ecosystem: Npm
Component: ghost
FLAT-TCX20 (CVE-2026-105679)
Insecure file upload In ghost
4.5
Medium
Ecosystem: Npm
Component: ghost
FLAT-4L7MT (CVE-2026-104411)
Insecure file upload In ghost
4.5
Medium
Ecosystem: Npm
Component: ghost
FLAT-PPTIV (CVE-2026-106122)
Asymmetric denial of service - ReDoS In com.rabbitmq:amqp-client
2.3
Low
Ecosystem: Maven
Component: com.rabbitmq:amqp-client
FLAT-L9FXK (CVE-2026-106457)
Improper authorization control for web services In @backstage/plugin-auth-backend-module-cloudflare-access-provider
4.9
Medium
Ecosystem: Npm
Component: @backstage/plugin-auth-backend-module-cloudflare-access-provider
FLAT-XLHSM (CVE-2026-106455)
Server-side request forgery (SSRF) In @backstage/plugin-techdocs-node
5.9
Medium
Ecosystem: Npm
Component: @backstage/plugin-techdocs-node
FLAT-KIRD9 (CVE-2026-106456)
Improper authorization control for web services In @backstage/plugin-proxy-backend
1.7
Low
Ecosystem: Npm
Component: @backstage/plugin-proxy-backend
FLAT-MFFNQ (CVE-2026-106458)
Improper authorization control for web services In @backstage/plugin-catalog-backend-module-bitbucket-server
2.3
Low
Ecosystem: Npm
Component: @backstage/plugin-catalog-backend-module-bitbucket-server
FLAT-PZ44K (CVE-2026-106459)
Server-side request forgery (SSRF) In @backstage/plugin-scaffolder-backend-module-sentry
6.0
Medium
Ecosystem: Npm
Component: @backstage/plugin-scaffolder-backend-module-sentry
FLAT-5M5G8 (CVE-2026-106115)
Out-of-bounds read In sixlabors.imagesharp
4.6
Medium
Ecosystem: NuGet
Component: sixlabors.imagesharp
FLAT-LOX2V (CVE-2026-106111)
Insecure encryption algorithm In sixlabors.imagesharp
1.7
Low
Ecosystem: NuGet
Component: sixlabors.imagesharp
FLAT-8O1QL (CVE-2026-106112)
Out-of-bounds read In sixlabors.imagesharp
4.6
Medium
Ecosystem: NuGet
Component: sixlabors.imagesharp
FLAT-G6WVM (CVE-2026-106116)
Improper resource allocation In sixlabors.imagesharp
2.7
Low
Ecosystem: NuGet
Component: sixlabors.imagesharp
FLAT-CFEUL (CVE-2026-106110)
Out-of-bounds read In sixlabors.imagesharp
4.6
Medium
Ecosystem: NuGet
Component: sixlabors.imagesharp
FLAT-F8D6S (CVE-2026-106113)
Out-of-bounds read In sixlabors.imagesharp
4.6
Medium
Ecosystem: NuGet
Component: sixlabors.imagesharp
FLAT-RHAUF (CVE-2026-106114)
Lack of data validation - Path Traversal In sixlabors.imagesharp
1.7
Low
Ecosystem: NuGet
Component: sixlabors.imagesharp
FLAT-M4LUB (CVE-2026-106440)
Remote command execution In hydra-optuna-sweeper
4.8
Medium
Ecosystem: PyPI
Component: hydra-optuna-sweeper
FLAT-Z5TJ5 (CVE-2026-106439)
Remote command execution In hydra-core
5.9
Medium
Ecosystem: PyPI
Component: hydra-core
FLAT-74AY4 (CVE-2026-106460)
Improper authorization control for web services In @backstage/plugin-auth-node
4.9
Medium
Ecosystem: Npm
Component: @backstage/plugin-auth-node
FLAT-6PT7V (CVE-2026-106101)
Lack of data validation - Type confusion In quasar
0.6
Low
Ecosystem: Npm
Component: quasar
FLAT-G8EA3 (CVE-2026-107217)
Out-of-bounds read In github.com/xuri/excelize/v2
6.6
Medium
Ecosystem: Go
Component: github.com/xuri/excelize/v2
FLAT-472QR (CVE-2026-107218)
Lack of data validation In github.com/xuri/excelize/v2
4.6
Medium
Ecosystem: Go
Component: github.com/xuri/excelize/v2
FLAT-TO85C (CVE-2026-107219)
Asymmetric denial of service - ReDoS In github.com/xuri/excelize/v2
6.6
Medium
Ecosystem: Go
Component: github.com/xuri/excelize/v2
FLAT-MVNI3 (CVE-2026-107220)
Out-of-bounds read In github.com/xuri/excelize/v2
4.3
Medium
Ecosystem: Go
Component: github.com/xuri/excelize/v2
FLAT-FSC0O (CVE-2026-107221)
Out-of-bounds read In github.com/xuri/excelize/v2
6.6
Medium
Ecosystem: Go
Component: github.com/xuri/excelize/v2
FLAT-L3IFJ (CVE-2026-107222)
Lack of data validation In github.com/xuri/excelize/v2
4.6
Medium
Ecosystem: Go
Component: github.com/xuri/excelize/v2
FLAT-9DP9F (CVE-2026-107223)
Lack of data validation In github.com/xuri/excelize/v2
4.9
Medium
Ecosystem: Go
Component: github.com/xuri/excelize/v2
FLAT-BIEHI (CVE-2026-107224)
Out-of-bounds read In github.com/xuri/excelize/v2
6.6
Medium
Ecosystem: Go
Component: github.com/xuri/excelize/v2
FLAT-ZLMKB (CVE-2026-107225)
Lack of data validation In github.com/xuri/excelize/v2
6.6
Medium
Ecosystem: Go
Component: github.com/xuri/excelize/v2
FLAT-SW9QT (CVE-2026-61429)
Server-side request forgery (SSRF) In praisonaiagents
4.0
Medium
Ecosystem: PyPI
Component: praisonaiagents
FLAT-8BD2N (CVE-2026-106443)
Lack of data validation In weasyprint
7.2
High
Ecosystem: PyPI
Component: weasyprint
FLAT-EKRPM (CVE-2026-104890)
Insecure file upload In kunstmaan/bundles-cms
4.8
Medium
Ecosystem: Packagist
Component: kunstmaan/bundles-cms
FLAT-J2I3M (CVE-2026-105680)
Improper authorization control for web services In ghost
4.9
Medium
Ecosystem: Npm
Component: ghost
FLAT-3T7EU (CVE-2026-93605)
Security controls bypass or absence In vm2
8.4
High
Ecosystem: Npm
Component: vm2
FLAT-MN4UB (CVE-2026-106441)
Remote command execution In hydra-core
4.4
Medium
Ecosystem: PyPI
Component: hydra-core
FLAT-TQBT2 (CVE-2026-106442)
Lack of data validation In hydra-core
4.8
Medium
Ecosystem: PyPI
Component: hydra-core
FLAT-W922O (CVE-2026-104891)
Improper authorization control for web services In @insumermodel/mppx-condition-gate
6.7
Medium
Ecosystem: Npm
Component: @insumermodel/mppx-condition-gate
FLAT-5T8BT (CVE-2026-106510)
Remote command execution In @backstage/plugin-techdocs-node
6.0
Medium
Ecosystem: Npm
Component: @backstage/plugin-techdocs-node
FLAT-G9IFD (CVE-2026-106558)
Insecure deserialization In @backstage/plugin-techdocs-node
5.2
Medium
Ecosystem: Npm
Component: @backstage/plugin-techdocs-node
FLAT-BKOP0 (CVE-2026-106559)
Lack of data validation - Path Traversal In @backstage/plugin-scaffolder-backend-module-confluence-to-markdown
1.9
Low
Ecosystem: Npm
Component: @backstage/plugin-scaffolder-backend-module-confluence-to-markdown
FLAT-6OEWS (CVE-2026-106560)
Lack of data validation - Path Traversal In @backstage/plugin-scaffolder-backend-module-confluence-to-markdown
2.3
Low
Ecosystem: Npm
Component: @backstage/plugin-scaffolder-backend-module-confluence-to-markdown
FLAT-USDH8 (CVE-2026-106562)
Improper authorization control for web services In @backstage/plugin-search-backend
0.6
Low
Ecosystem: Npm
Component: @backstage/plugin-search-backend
FLAT-P3U36 (CVE-2026-106563)
Improper authorization control for web services In @backstage/plugin-kubernetes-backend
0.6
Low
Ecosystem: Npm
Component: @backstage/plugin-kubernetes-backend
FLAT-WLQKH (CVE-2026-106561)
Improper authorization control for web services In @backstage/plugin-kubernetes-backend
1.1
Low
Ecosystem: Npm
Component: @backstage/plugin-kubernetes-backend