ALSA-2026:64796 Important: valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

WordPress SureForms plugin <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload vulnerability

Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload vulnerability discovered by daroo in WordPress Plugin SureForms versions = 2.12.2...

Malicious code in array-frames (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063 The npm package [email protected] advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On...

MAL-2026-15969 Malicious code in array-frames (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063 The npm package [email protected] advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On...

CVE-2026-18406

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18406 SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18406

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a Text Field Entity-Encoded Payload in all versions up to and including 2.12.2 . The root cause is insufficient input sanitization and output escaping ...

CVE-2026-18406 SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-71884

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes i...

SUSE CVE-2026-80801

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...

PT-2026-86322

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18406: Improper Neutralization of Input During Web Page Generation

The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes i...

DEBIAN-CVE-2026-57159

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

CVE-2026-57159

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

CVE-2026-57159 PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

CVE-2026-57159

PJSIP is an open-source multimedia communication library in C. Prior to commit 673b978 , a crafted remote SDP offer or answer can trigger an out-of-bounds read and write in assign_pt_and_update_map() within pjmedia/src/pjmedia/sdp_neg.c, which indexes fixed-size internal tables using payload-type...

CVE-2026-57159

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

CVE-2026-57159 PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

EUVD-2026-71653

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

AZL-99522 CVE-2026-80801 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target discovery payload lengths microreadtargetdiscovered parses target discovery payloads from skb-data according to the HCI gate. The fixed field offsets and UID copies were checked only against the...