OPENSUSE-SU-2026:10406-1 lemon-3.51.3-1.1 on GA media

These are all security issues fixed in the lemon-3.51.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10401-1 freeciv-3.2.4-1.1 on GA media

These are all security issues fixed in the freeciv-3.2.4-1.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2026-14005

The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVE-2026-3997

The CVE-2026-3997 entry describes a Stored Cross-Site Scripting vulnerability in the WordPress Text Toggle plugin (versions up to 1.1). The flaw is in avp_texttoggle_part_shortcode(): the ‘title’ shortcode attribute is taken from user input and concatenated into HTML output without escaping, both...

CVE-2026-1093 WPFAQBlock– FAQ & Accordion Plugin For Gutenberg <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute

The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'wpfaqblock' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied...

PT-2026-26867

The Text Toggle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute of the tt part and tt shortcodes in all versions up to and including 1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes...

WordPress plugin WPFAQBlock– FAQ & Accordion Plugin For Gutenberg 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

coturn-4.9.0-1.1 on GA media (moderate)

coturn-4.9.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10375-1 Rating: moderate Cross-References: CVE-2025-69217 CVE-2026-27624 CVSS scores: CVE-2025-69217 SUSE : 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves 2 vulnerabilitie...

OPENSUSE-SU-2026:10390-1 tempo-cli-2.10.3-1.1 on GA media

These are all security issues fixed in the tempo-cli-2.10.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10386-1 ImageMagick-7.1.2.17-1.1 on GA media

These are all security issues fixed in the ImageMagick-7.1.2.17-1.1 package on the GA media of openSUSE Tumbleweed...

skaffold-2.18.0-1.1 on GA media (moderate)

skaffold-2.18.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10369-1 Rating: moderate Cross-References: CVE-2025-15558 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

OPENSUSE-SU-2026:10380-1 python311-uv-0.10.11-1.1 on GA media

These are all security issues fixed in the python311-uv-0.10.11-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10379-1 python311-CairoSVG-2.9.0-1.1 on GA media

These are all security issues fixed in the python311-CairoSVG-2.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10375-1 coturn-4.9.0-1.1 on GA media

These are all security issues fixed in the coturn-4.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10329-1 kubelogin-0.2.16-1.1 on GA media

These are all security issues fixed in the kubelogin-0.2.16-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10324-1 MozillaFirefox-148.0.2-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-148.0.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10325-1 clamav-1.5.2-1.1 on GA media

These are all security issues fixed in the clamav-1.5.2-1.1 package on the GA media of openSUSE Tumbleweed...

Winter vulnerable to privilege escalation by authenticated backend users

Impact Affected versions of Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially crafted requests to the backend while logged in. To actively exploit this security...

CVE-2026-1825

The Show YouTube video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'syv' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2026-1825 Show YouTube video <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Show YouTube video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'syv' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...