CLEANSTART-2026-OX66799 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...

RHEL 6 : dracut (RHSA-2026:79114)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79114 advisory. The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. Th...

PT-2026-108106

Name of the Vulnerable Software and Affected Versions Malcolm kiosk affected versions not specified Description The Flask application exposes the 'POST /script call/' endpoint without authentication and utilizes wildcard Cross-Origin Resource Sharing CORS, which allows requests from any origin...

Wireshark 1.4.x < 1.4.9 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.4.9. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.4.9 advisory. - Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service application crash via...

UBUNTU-CVE-2026-106575

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...

PT-2026-107976

ImageMagick before 7.1.2-31 contains a resource leak vulnerability that allows attackers to leave file pointers open by supplying a crafted magick script. Attackers can process malicious magick scripts to leak file descriptors, potentially exhausting resources and causing denial of service...

EUVD-2026-92633

Ghost : Stored XSS via SVG Files in Content Imports...

EUVD-2026-92756

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization...

GHSA-8575-CR6V-7JH4 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Impact SVG media thumbnails, and SVG images uploaded with a non-SVG file extension, were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. Vulnerable versio...

Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Impact SVG media thumbnails, and SVG images uploaded with a non-SVG file extension, were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. Vulnerable versio...

Arbitrary File Upload

Overview @payloadcms/storage-vercel-blob is a Payload storage adapter for Vercel Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData an...

Arbitrary File Upload

Overview @payloadcms/storage-s3 is a Payload storage adapter for Amazon S3 Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related file-type...

Arbitrary File Upload

Overview @payloadcms/storage-gcs is a Payload storage adapter for Google Cloud Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relat...

Arbitrary File Upload

Overview @payloadcms/storage-azure is a Payload storage adapter for Azure Blob Storage Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relat...

Arbitrary File Upload

Overview @payloadcms/storage-uploadthing is a Payload storage adapter for uploadthing Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and relate...

Arbitrary File Upload

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Arbitrary File Upload via insufficient validation of upload identity and MIME type in the upload handling pipeline, specifically in generateFileData and related...

EUVD-2026-92770

Ghost: Stored XSS via File Uploads on Local Storage...

CVE-2026-106575

A flaw was found in ImageMagick. An attacker could provide a specially crafted Magick script that fails to release opened file pointers during execution. Repeated processing of such scripts can exhaust available file descriptors system resources used to manage open files, resulting in a Denial of...

DEBIAN-CVE-2026-106575

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...

CVE-2026-106575

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...