PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes

Impact PHPUnit forwards PHP INI settings to child processes used for isolated/PHPT test execution as -d name=value command-line arguments without neutralizing INI metacharacters. Because PHP's INI parser interprets " as a string delimiter, ; as the start of a comment, and most importantly a newli...

ChurchCRM 安全漏洞

ChurchCRM is an open-source CRM system developed for churches. Versions of ChurchCRM prior to 7.2.0 contained security vulnerabilities. These vulnerabilities stemmed from the lack of file extension filtering and CSRF token validation in the database backup restoration function, which could lead t...

GHSA-XGP8-3HG3-C2MH vulnerabilities

Vulnerabilities for packages: atuin, berg, lychee, pixi, rye, samply, ztunnel, linkerd-extension-init, rustup, ntpd-rs, kdash, zellij, sdp-k8s-injector, uv, deno, sqlx, zola, xh, qdrant, py3-xet-core, linkerd2-proxy, linkerd-network-validator, parseable, tealdeer, wasmtime, linkerd2, cargo-audit,...

GHSA-965H-392X-2MH5 vulnerabilities

Vulnerabilities for packages: atuin, berg, lychee, pixi, rye, samply, ztunnel, linkerd-extension-init, rustup, ntpd-rs, kdash, zellij, sdp-k8s-injector, uv, deno, sqlx, zola, xh, qdrant, py3-xet-core, linkerd2-proxy, linkerd-network-validator, parseable, tealdeer, wasmtime, linkerd2, cargo-audit,...

GHSA-965H-392X-2MH5 vulnerabilities

Vulnerabilities for packages: samply, cargo-audit, linkerd2, py3-xet-core, kdash, linkerd2-proxy, asciinema, linkerd2-cni-plugin, zola, atuin, ztunnel, komodo, fnm, wasmtime, wasmcloud, sdp-k8s-injector, sentry-cli, tealdeer, shadowsocks-rust, zizmor, zellij, sccache, pixi, uv, parseable,...

GHSA-XGP8-3HG3-C2MH vulnerabilities

Vulnerabilities for packages: samply, cargo-audit, linkerd2, py3-xet-core, kdash, linkerd2-proxy, asciinema, linkerd2-cni-plugin, zola, atuin, ztunnel, komodo, fnm, wasmtime, wasmcloud, sdp-k8s-injector, sentry-cli, tealdeer, shadowsocks-rust, zizmor, zellij, sccache, pixi, uv, parseable,...

EUVD-2026-23459

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.6. This is due to insufficient file type validation that occurs when custom blacklist types are configured, which replaces the default...

xrdp 安全漏洞

XRDPT is an open-source remote desktop protocol server developed by Neutrinolabs. Versions of XRDPT prior to 0.10.5 contain security vulnerabilities. These vulnerabilities stem from insufficient validation of the size parameter in the EGX implementation, leading to a heap-based buffer overflow th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007421)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007421 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6gsosegment syzbot was able to craft a packet with very long...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-007221)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007221 advisory. In the Linux kernel, the following vulnerability has been resolved: iouring: fix overflows checks in provide buffers Colin reported before possible overflow and sign...

[SECURITY] Fedora 44 Update: kf6-krunner-6.25.0-1.fc44

KRunner provides a parallelized query system extendable via plugins...

Securing AI Applications From Inception to Deployment

Extending the Wiz AI APP into the code layer to detect AI-specific risks at inception, validate exploitability at runtime, and orchestrate remediation with agents that understand your codebase...

SUSE SLES12 Security Update : libssh (SUSE-SU-2026:1344-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1344-1 advisory. - CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler bsc1259377. - CVE-2026-0964: SCP protocol path travers...

SUSE SLED15 / SLES15 Security Update : xorg-x11-server (SUSE-SU-2026:1330-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1330-1 advisory. - CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap bsc1260922. - CVE-2026-34000: XKB Out-of-bounds Rea...

SUSE SLES15: xorg-x11-server / xorg-x11-server-Xvfb / xorg-x11-server-extra / etc (SUSE-SU-2026:1331-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1331-1 advisory. - CVE-2026-33999: XKB integer underflow in XkbSetCompatMap bsc1260922. - CVE-2026-34000: XKB out-of-bounds read in...

bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone

A flaw was found in BIND. A remote attacker could exploit this vulnerability by sending a maliciously crafted DNSSEC-validated zone to a BIND resolver. This could cause the resolver to consume excessive CPU resources, leading to a denial of service DoS for legitimate users...

CVE-2026-33824

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network...

SUSE-SU-2026:1344-1 Security update for libssh

This update for libssh fixes the following issues: - CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler bsc1259377. - CVE-2026-0964: SCP protocol path traversal in sshscppullrequest bsc1258049. - CVE-2026-0965: possible denial of service when parsing unexpected...

File-Cleaner-

I learn from this Project w Never trust user input: Attackers c...

SUSE CVE-2026-2332

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...