CVE-2026-15652: Improper Neutralization of Input During Web Page Generation

The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'align' Block Attribute in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for...

Security update for the Linux Kernel (Live Patch 79 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.299 fixes various security issues The following security issues were fixed: CVE-2026-31685: netfilter: ip6teui64: reject invalid MAC header for all packets bsc1263670. CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new...

PT-2026-60282

Name of the Vulnerable Software and Affected Versions Cilium versions 1.19.0 through 1.19.4 Description When configured with a custom clusterName instead of the default value, the parser incorrectly instantiates a pod selector on selectorless peer definitions. This occurs during the processing of...

kernel: XFS data corruption using reflink

A flaw was found in the XFS filesystem. A race condition in the copy-on-write mechanism for reflinked files can cause writes to bypass the copy-on-write process and modify shared data blocks directly. As a result, data intended for a private copy may be written to the original shared location,...

Decidim: HTML content blocks allow stored script execution

Description A privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an HTML block, and the public page renders it with htmlsafe and no output escaping. Technical description This issue lets any admin who can edit an affected landing page store arbitrar...

GHSA-533C-2VH9-4R86 Decidim: HTML content blocks allow stored script execution

Description A privileged admin user who can edit an affected landing page can store arbitrary HTML/JavaScript in an HTML block, and the public page renders it with htmlsafe and no output escaping. Technical description This issue lets any admin who can edit an affected landing page store arbitrar...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the htmlcontent process. An attacker can execute arbitrary scripts in the browsers of visitors by injecting malicious HTML or JavaScript into an HTML block that is rendered without proper sanitization. This ...

PYSEC-2026-3000 pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small

Impact The argon2i32 implementation does not check the nbblocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i32 will write past the end of the buffer and possibly corrupt the heap. Patches Fixed in 4.0.2.8, which now verifies that nbblock...

gps-building-blocks (>=1.2.3, <=1.25.0) potentially affected by CVE-2026-40961 via apache-airflow (1.10.14)

apache-airflow PYPI version 1.10.14 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - gps-building-blocks =1.2.3, =1.25.0 Source cves: CVE-2026-40961 Source advisory: OSV:PYSEC-2026-2345...

gps-building-blocks (>=1.2.3, <=1.25.0) potentially affected by CVE-2026-42358 via apache-airflow (1.10.14)

apache-airflow PYPI version 1.10.14 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - gps-building-blocks =1.2.3, =1.25.0 Source cves: CVE-2026-42358 Source advisory: OSV:PYSEC-2026-2343...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +2 more potentially affected by CVE-2026-42358 via apache-airflow (2.0.0)

apache-airflow PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - aglow =0.1.0rc3, =0.1.0rc4 - ai-flow 0.3.1 - dataverk-airflow 0.3.12 - gps-building-blocks 1.2.2 Source cves: CVE-2026-42358 Source...

agentic-blocks (>=0.1.36, <=0.1.37), agno-opensandbox-toolkit (0.1.0) +2 more potentially affected by CVE-2026-10105 via agno (>=2.0.9, <=2.5.16)

agno PYPI version =2.0.9, =0.1.36, =1.3.3, =2026.2.60, =2026.6.61 Source cves: CVE-2026-10105 Source advisory: OSV:PYSEC-2026-2333...

Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)

Server-Side Request Forgery SSRF Bypass via HTTP Redirect Following in Web-Fetch, Image-Load, and Chat-Completion Endpoints SummaryThe validateurl function in backend/openwebui/retrieval/web/utils.py only validates the initial URL submitted by the caller. The HTTP clients used downstream sync...

docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler

ImpactThe URLInputHandler class in doclinggraph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no...

scikit-blocks (0.0.1), scikit-lego (0.1.0) +1 more potentially affected by CVE-2026-42557 via jupyterlab (0.35.4)

jupyterlab PYPI version 0.35.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - scikit-blocks 0.0.1 - scikit-lego 0.1.0 - skillpub =0.2.41, =0.2.90 Source cves: CVE-2026-42557 Source advisory: OSV:PYSEC-2026-2537...

scikit-blocks (0.0.1), scikit-lego (0.1.0) +1 more potentially affected by CVE-2026-40171 via jupyterlab (0.35.4)

jupyterlab PYPI version 0.35.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - scikit-blocks 0.0.1 - scikit-lego 0.1.0 - skillpub =0.2.41, =0.2.90 Source cves: CVE-2026-40171 Source advisory: OSV:PYSEC-2026-2538...

gps-building-blocks (>=1.2.3, <=1.25.0) potentially affected by CVE-2026-38743 via apache-airflow (1.10.14)

apache-airflow PYPI version 1.10.14 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - gps-building-blocks =1.2.3, =1.25.0 Source cves: CVE-2026-38743 Source advisory: OSV:PYSEC-2026-2351...

gps-building-blocks (>=1.2.3, <=1.25.0) potentially affected by CVE-2026-40690 via apache-airflow (1.10.14)

apache-airflow PYPI version 1.10.14 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - gps-building-blocks =1.2.3, =1.25.0 Source cves: CVE-2026-40690 Source advisory: OSV:PYSEC-2026-2356...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +2 more potentially affected by CVE-2025-54550 via apache-airflow (2.0.0)

apache-airflow PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - aglow =0.1.0rc3, =0.1.0rc4 - ai-flow 0.3.1 - dataverk-airflow 0.3.12 - gps-building-blocks 1.2.2 Source cves: CVE-2025-54550 Source...

gps-building-blocks (>=1.2.3, <=1.25.0) potentially affected by CVE-2025-54550 via apache-airflow (1.10.14)

apache-airflow PYPI version 1.10.14 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - gps-building-blocks =1.2.3, =1.25.0 Source cves: CVE-2025-54550 Source advisory: OSV:PYSEC-2026-2353...