[SECURITY] Fedora 44 Update: lyx-2.5.2-1.fc44

LyX is a modern approach to writing documents which breaks with the obsolete "typewriter paradigm" of most other document preparation systems. It is designed for people who want professional quality output with a minimum of time and effort, without becoming specialists in typesetting. The major...

CVE-2026-77075 n8n before 1.123.69 Expression Injection via Resource Locator

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...

WordPress SM Page Duplicator plugin <= 1.0.0 - Editor+ SQL Injection via Page Duplication vulnerability

Editor+ SQL Injection via Page Duplication vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin sm page duplicator versions = 1.0.0...

CVE-2026-15049

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

CVE-2026-74992 Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...

EUVD-2026-63206

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...

CVE-2026-15049

The Depicter — Popup & Slider Builder WordPress plugin (versions before 4.8.0 ) contains an arbitrary file upload vulnerability. The root cause is a failure to validate the type of files uploaded via the import feature and a failure to remove malformed uploads. This allows users with editor-level...

CVE-2026-15049 Depicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

EUVD-2026-62906

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the SPL when that user...

EUVD-2026-62907

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

EUVD-2026-63107

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language SPL commands through the Data Model Editor using the permissions of the affected user. Th...

webpack_devserver 5.2.5 Cross Site Request Forgery

webpackdevserver versions 5.2.5 and below suffer from a cross site request forgery vulnerability. Exploit Title: webpackdevserver 5.2.5 - Csrf Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/webpack/webpack-dev-server Software Link:...

PT-2026-78890

Name of the Vulnerable Software and Affected Versions Depicter — Popup & Slider Builder WordPress plugin versions prior to 4.8.0 Description Users with editor-level access can upload arbitrary files, including executable PHP scripts, into a web-accessible directory. This occurs because the import...

CVE-2026-15049: Unrestricted Upload of File with Dangerous Type

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file including executable PHP into a web-accessible...

CVE-2026-76342

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

CVE-2026-76341

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the SPL when that user...

CVE-2026-76255

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user into running arbitrary Search Processing Language SPL commands through the Data Model Editor using the permissions of the affected user. Th...

CVE-2026-59992

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

CVE-2026-76342 Risky Commands Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

CVE-2026-76342 Risky Commands Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...