CVE-2026-63220 CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request a...

JLSEC-2026-830

In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file...

CVE-2026-14266 — Updated!

CVE-2026-14266 Poc: 7-Zip XZ Heap Buffer Overflow PoC Generator Proof of Concept generator for reproducing the XZ heap buffer overflow vulnerability in 7-Zip. The script creates a specially crafted .xz archive designed to reproduce the crash condition in the vulnerable multi-threaded XZ...

CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7

CVE-2026-56852 affecting package prometheus-adapter for versions less than 0.12.0-7. A patched version of the package is available...

CVE-2026-56852 affecting package containerized-data-importer for versions less than 1.62.0-7

CVE-2026-56852 affecting package containerized-data-importer for versions less than 1.62.0-7. A patched version of the package is available...

CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7

CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7. A patched version of the package is available...

CVE-2026-56852 affecting package cri-tools for versions less than 1.32.0-7

CVE-2026-56852 affecting package cri-tools for versions less than 1.32.0-7. A patched version of the package is available...

CVE-2026-56852 affecting package azcopy for versions less than 10.25.1-7

CVE-2026-56852 affecting package azcopy for versions less than 10.25.1-7. A patched version of the package is available...

EUVD-2026-50444

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 or V08 handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers,...

CVE-2026-13425 Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-14266: Heap-based Buffer Overflow

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

Security update for helm

This update for helm fixes the following issues: Update to version 3.21.3. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. CVE-2026-56852: golang.org/x/text/unicode/norm: handling input...

CVE-2026-14870

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

ROS-20260728-73-0003

The vulnerability in ImageMagick 7 is related to the lack of memory release after the effective lifespan of the component. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-14870: Improper Neutralization of Input During Web Page Generation

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2026-65439 WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65438 WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

PT-2026-65673

These are all security issues fixed in the ffmpeg-7-7.1.5-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-65439: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-14236: URL Redirection to Untrusted Site

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...