CVE-2026-57531

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

EUVD-2026-48736

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

CVE-2026-57531

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

CVE-2026-57531 Milkdown < 7.21.3 DOM XSS via innerHTML Assignment

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

GO-2026-5585 Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber

Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber...

GHSA-RG4H-FPCP-2QM8 Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Summary Microsoft Kiota resolved OpenAPI $refs by fetching remote https URLs and reading local files including absolute / out-of-tree paths, inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary...

CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

OESA-2026-3152 wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. Security Fixes: GNU Wget does n...

OESA-2026-3116 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

OESA-2026-3114 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

OESA-2026-3115 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

CVE-2026-14172

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...

WordPress AI Copilot – Content Generator plugin <= 1.5.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin AIWU versions = 1.5.4...

CVE-2026-14172

CVE-2026-14172 affects Rapid7 InsightVM, Nexpose, and the Insight Agent. The issue allows a local, low-privilege user to execute discovered executables during authenticated assessments due to lack of file ownership validation, enabling code execution as the scan credential (Scan Engine) or as roo...

SUSE CVE-2026-16317

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

EUVD-2026-48463

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

EUVD-2026-48438

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...

PT-2026-64227

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

PT-2026-76594

Name of the Vulnerable Software and Affected Versions kin-openapi versions 0.2.0 through 0.143.0 Description An unauthenticated remote denial of service exists when the openapi3filter.ValidateRequest function processes an operation that declares a content parameter where the application/json medi...

SUSE SLES12 Security Update : wget (SUSE-SU-2026:3205-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3205-1 advisory. This update for wget fixes the following issues - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side reques...