CVE-2026-74803

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

EUVD-2026-62451

phpMyFAQ before 4.1.7 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...

CVE-2026-76206 phpMyFAQ before 4.1.7 Information Disclosure via PDF Export

phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-upda...

MINI-C8M7-5VP6-MR9J

Bulletin has no description...

EUVD-2026-62434

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

CVE-2026-74803

The Joomla Zoo extension (versions before 4.1.64) accepts arbitrary files via its image element when the client-supplied Content-Type falls within the image MIME group, enabling unauthenticated remote code execution. No exploitation details are provided; update to Zoo 4.1.64 or later. CVSS 4.0 sc...

CVE-2026-74803 Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

CVE-2026-74803 Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

httpd: incomplete fix for CVE-2023-38709

A flaw was found in httpd. The response headers are not sanitized before an HTTP response is sent when a malicious backend can insert a Content-Type, Content-Encoding, or some other headers. These issues lead to HTTP response splitting. This CVE provides a "complete" fix for CVE-2023-38709...

httpd: SSRF in Apache HTTP Server with mod_proxy loaded

A Server-side request forgery SSRF vulnerability exists in Apache httpd when the server has modproxy loaded and is configured with modheaders to modify the Content-Type header in the HTTP request or response using a value supplied by the user. Under this configuration, this flaw allows an attacke...

httpd: SSRF in Apache HTTP Server with mod_proxy loaded

A Server-side request forgery SSRF vulnerability exists in Apache httpd when the server has modproxy loaded and is configured with modheaders to modify the Content-Type header in the HTTP request or response using a value supplied by the user. Under this configuration, this flaw allows an attacke...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc

A flaw was found in Apache HTTP Server, specifically within the modxml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service,...

BIT-GOLANG-2026-56864 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...

OPENSUSE-SU-2026:21593-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go1.26.6 released 2026-08-13, bsc1255111. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...

CVE-2025-11729

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

CVE-2025-11729: Improper Authorization

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

PT-2026-80792

Name of the Vulnerable Software and Affected Versions Drupal Link content parser affected versions not specified Description A security issue exists within the Drupal Link content parser. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

The vulnerability of the Content Credentials SDK libraries arises from incorrect restrictions on the path name to the catalog, allowing attackers to write arbitrary files.

The vulnerability of the Content Credentials SDK libraries is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a attacker to write arbitrary files...

The vulnerability of the Content Credentials SDK library, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of Content Credentials SDK libraries is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2026-78751

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and cause arbitrary JavaScript to run in the browser of another user when that user opens a crafted tour link. The JavaScript runs in the brows...