GHSA-QGVJ-QCF8-XQ73 Backstage: Improper URL validation in catalog entity placeholder resolution

Impact An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user. Patches Patched in...

GHSA-G2V8-7JHW-PP8P Backstage: Sensitive information exposure in Scaffolder

Impact An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. Patches Patched in...

EUVD-2026-94059

Backstage: Sensitive information exposure in Scaffolder...

CVE-2026-106571

A flaw was found in ImageMagick. A local attacker can cause a Denial of Service DoS by issuing a specially crafted call to the GetVirtualPixels function. An integer calculation error allows data to be written beyond allocated heap memory boundaries, resulting in an unexpected process crash...

CVE-2026-106566

A flaw was found in ImageMagick. During the cleanup of temporary symbolic links symlinks used by delegate programs, the application fails to properly check the MAGICKSHREDPASSES environment variable. A local privileged user can exploit this vulnerability to overwrite files with random data,...

CVE-2026-106066

A heap-based buffer overflow exists in GIMP’s raw data export plug-in . The vulnerability is caused by an integer overflow during the calculation of memory requirements (width * height * bytes-per-pixel) for very large images. This leads g_malloc() to allocate insufficient memory, which is then o...

CVE-2026-106066

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, gmalloc sizing based on overflowing width height bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow...

CVE-2026-106066 Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, gmalloc sizing based on overflowing width height bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow...

EUVD-2026-94528

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, gmalloc sizing based on overflowing width height bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow...

CVE-2026-106066 Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, gmalloc sizing based on overflowing width height bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow...

CVE-2026-106066

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, gmalloc sizing based on overflowing width height bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow Mitigation Avoid raw export...

Security Bulletin:Improper Enforcement of Message Integrity in Erlang/OTP SSL: Vulnerability in tls_gen_connection Module Allows Unauthenticated Data Injection

Summary Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl tlsgenconnection module allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server...

WordPress Super Forms plugin <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter vulnerability

Unauthenticated Arbitrary Directory Deletion via 'data...filessubdir' Parameter vulnerability discovered by d.v4ns3c in WordPress Plugin Super Forms versions = 6.3.316...

CVE-2026-95605

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...

CVE-2026-95534

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Object Injection. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through 2.0.19...

AZL-107739 CVE-2026-92542 affecting package moby-engine 25.0.3-20

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec...

CVE-2026-20173

A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service DoS condition. This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this vulnerability by...

EUVD-2026-94491

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4...

CVE-2026-95606 WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4...

CVE-2026-95606

The WordPress The Events Calendar plugin (versions ≤ 6.17.4 ) is vulnerable to a PHP Object Injection vulnerability due to the deserialization of untrusted data . This flaw allows an attacker to inject objects, potentially leading to significant impact on confidentiality, integrity, and availabil...