GitLab is a web-based Git repository manager with wiki and issue-tracking features. GitLab is similar to GitHub, but GitLab has an open-source version, unlike GitHub.

GitLab

HashiCorp's Vault secures, stores, and controls access to tokens, passwords, certificates, API keys, and other sensitive resources in modern data centers. For each resource, Vault handles leasing, revocation, rolling, and auditing.

HashiCorp Vault

GitLab Enterprise is a self-hosted, scalable, and secure platform that provides DevOps and CI/CD capabilities for software development teams. It offers advanced features, integrations, and support for organizations requiring enhanced collaboration and security. GitLab Enterprise is available in two tiers: Premium and Ultimate.

Gitlab Enterprise

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service due to insufficient resource allocation limits when retrieving notes under certain conditions.

CVE-2025-6016

Linux

Linux Kernel

VulnCheck NVD++

Windows

Windows Cumulative Update

Nexus by Sonatype is a repository manager that organizes, stores, and distributes artifacts needed for development. With Nexus, developers can completely control access to, and deployment of, every artifact in an organization from a single location, making it easier to distribute software.

Sonatype Nexus 3

Nexus by Sonatype is a repository manager that organizes, stores, and distributes artifacts needed for development. With Nexus, developers can completely control access to and deployment of every artifact in an organization from a single location, making it easier to distribute software.

Sonatype Nexus

CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.

CVE-2026-5189

JavaScript is a high-level, interpreted programming language essential for creating interactive web applications, running directly in web browsers to enable dynamic content and user interface enhancements. It is integral to the web development stack, working seamlessly with HTML and CSS to build responsive and feature-rich websites.

JavaScript

Grafana is an open-source visualization and analytics software. It allows you to query, visualize, alert on, and explore your metrics and time-series database (TSDB) data.

Grafana

Wolfi is a community Linux OS designed for the container and cloud-native era; it is a Linux distribution based on Alpine.

Wolfi

Chainguard is a Linux distribution based on Alpine. It's the commercial version of the Wolfi distro.

Chainguard

OpenClaw (also known as Moltbot or Clawdbot) is a self-hosted personal AI assistant that integrates with various messaging platforms and mobile or desktop operating systems to provide voice and text interactions. The architecture separates the control plane from the assistant, allowing users to host the technology on their own devices while utilizing live canvas rendering.

OpenClaw (formerly Moltbot or Clawdbot)

Debian GNU/Linux is a Linux distribution composed of free and open-source software.

Linux Debian

Fedora is a popular open-source, Linux-based operating system.

Linux Fedora

Red Hat Enterprise Linux is a Linux distribution developed by Red Hat for the commercial market.

Linux Red Hat

Echo is a secure, minimal Linux OS built vulnerability-free. It is fully compatible across environments and continuously patched - making it a clean, dependable base layer for modern applications. Echo is used by organizations focused on security and reliability, including those with compliance or FIPS requirements.

Echo

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1.

>**Wiz Threat Research note:** 
>This vulnerability's CVSS vector has been overridden to Privileges Required LOW by the Wiz Research team, as exploitation is situational, and requires chaining with an additional prototype pollution vulnerability.

CVE-2026-40175

Debian

Debian Security Tracker

GitHub Advisory Database

MinimOS

Minimus

Red Hat

Red Hat Errata

Python is a high-level, general-purpose programming language. Its key feature is the high readability of the code. It supports multiple programming paradigms, including Object-Oriented Programming (OOP) and Functional Programming.

Python

Marimo is a reactive notebook for Python that enables reproducible experiments, interactive data exploration, and deployment as web applications, stored as pure Python files.

Marimo

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint /terminal/ws lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., /ws) that correctly call validate_auth() for authentication, the /terminal/ws endpoint only checks the running mode and platform support before accepting connections, completely skipping authentication verification. This vulnerability is fixed in 0.23.0.

CVE-2026-39987

FortiClient EMS is a security solution designed to provide visibility, control, and proactive defense for endpoints within an organization. It serves as a central management console for deployment, control, and security assessment of endpoints.

FortiClient EMS

A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

CVE-2026-35616

WordPress is a content management system paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system, referred to within WordPress as Themes.

WordPress

Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4.

CVE-2026-22337

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affects Directorist Booking: from n/a before 3.0.2.

CVE-2026-22336

The Highland Software Custom Role Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 1.0.0. This is due to insufficient authorization checks in the hscrm_save_user_roles() function, which is hooked to the personal_options_update action accessible by any authenticated user. This makes it possible for authenticated attackers, with Subscriber-level access or higher, to potentially modify user roles via the profile update form.

CVE-2026-7106

Ubuntu is a Linux distribution based on Debian, mostly composed of free and open-source software. Ubuntu is officially released in three editions: Desktop, Server, and Core for internet of things devices and robots. All the editions can run on the computer alone or in a virtual machine.

Linux Ubuntu

Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVE-2026-6786

Ubuntu

Ubuntu Security Tracker

Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2025-6016	MEDIUM	6.5	GitLab	cpe:2.3:a:gitlab:gitlab	No	Sì	Apr 22, 2026
CVE-2026-5189	CRITICAL	9.2	Sonatype Nexus 3	cpe:2.3:a:sonatype:nexus_repository_manager_3	No	Sì	Apr 15, 2026
CVE-2026-40175	MEDIUM	4.8	JavaScript	kibana-9.2	No	Sì	Apr 10, 2026
CVE-2026-39987	CRITICAL	9.3	Python	marimo	Sì	Sì	Apr 09, 2026
CVE-2026-35616	CRITICAL	9.8	FortiClient EMS	cpe:2.3:a:fortinet:forticlient_enterprise_management_server	Sì	Sì	Apr 04, 2026

CVE ID	Severità	Punteggio	Tecnologie	Nome del componente	Exploit CISA KEV	Ha la correzione	Data di pubblicazione
CVE-2026-22337	CRITICAL	9.8	WordPress	directorist-social-login	No	No	Apr 27, 2026
CVE-2026-22336	CRITICAL	9.3	WordPress	directorist-booking	No	No	Apr 27, 2026
CVE-2026-7106	HIGH	8.8	WordPress	highland-software-custom-role-manager	No	Sì	Apr 27, 2026
CVE-2026-6786	HIGH	8.1	Linux Debian	firefox	No	Sì	Apr 26, 2026
CVE-2026-6785	HIGH	8.1	Linux Debian	thunderbird	No	Sì	Apr 26, 2026

Database delle vulnerabilità Wiz

Esplora per tecnologia

Filtri popolari

Alto profilo

Più recenti

I numeri delle vulnerabilità

Il buono, il cattivo e il vulnerabile

Ulteriori risorse Wiz

PEACH

Pronti a vedere Wiz in azione?