MAL-2026-16069 Malicious code in reactlogo-load (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f The package presents itself as a logo/color utility but its exported loadLogo function extracts a URL from LSB-encoded bits of a PNG, fetches the...

CVE-2026-77186 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-77186 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-77186 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-74396

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87550

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

Linux Distros Unpatched Vulnerability : CVE-2026-87550

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a...

CARTS: Contextual Autoregressive Rank Transcoding Steganography for Full-Capacity Keyed Text Encoding

Autoregressive language models can be used to transform a payload text into a stegotext of identical token length by preserving per-position rank information across contexts - a methodology we formalize as Contextual Autoregressive Rank Transcoding Steganography CARTS. While the Calgacus...

MiracleLinux 9 : grafana-pcp-5.1.1-17.el9_8.1 (AXSA:2026-1792:12)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1792:12 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Deni...

TencentOS Server 3: python-pyasn1 (TSSA-2026:0990)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0990 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

PT-2026-89107

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

PT-2026-88798

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-79952: Improper Encoding or Escaping of Output

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Encoding or Escaping of Output vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to launch of...

CVE-2026-87550: Improper Encoding or Escaping of Output

Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...