PT-2026-6417

Summary A stored DOM XSS vulnerability exists in the "Recent Orders" dashboard widget. The Order Status Name is rendered via JavaScript string concatenation without proper escaping, allowing script execution when any admin visits the dashboard. Users are recommended to update to the patched 5.5.2...

WordPress plugin “Save as PDF Plugin” by PDFCrowd has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-4617

Name of the Vulnerable Software and Affected Versions Save as PDF Plugin for WordPress versions prior to 4.5.6 Description The Save as PDF Plugin for WordPress is susceptible to Reflected Cross-Site Scripting through the options parameter. Insufficient input sanitization and output escaping allow...

Mastodon security vulnerabilities

Mastodon is an open-source social networking server based on ActivityPub. Versions of Mastodon prior to 4.3.18, 4.4.12, and 4.5.5 contained security vulnerabilities. These vulnerabilities stemmed from the lack of restrictions on the maximum number of remote post voting options, which could lead t...

EUVD-2026-3773

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.0.0 through 2.54.0, users that have the staff status may freely change their permissions, including giving themselves superuser status and joining the admin group, which gives them full access to...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003877)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003877 advisory. There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgaconinvertregion function in drivers/video/console/vgacon.c. Tenable has extracted...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001489)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001489 advisory. There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgaconinvertregion function in drivers/video/console/vgacon.c. Tenable has extracted...

MiracleLinux 3 : tomcat5-5.5.23-0jpp.38.0.1.AXS3 (AXSA:2013-370:01)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-370:01 advisory. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Jav...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003081)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003081 advisory. The replacemapfdwithmapptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allows local use...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000617)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000617 advisory. The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local...

CVE-2026-21277 InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Adobe InDesign Desktop 缓冲区错误漏洞

Adobe InDesign is a professional desktop publishing software developed by Adobe for layout and page layout in print and digital media. Adobe InDesign suffers from a buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

Adobe InCopy 安全漏洞

Adobe InCopy is a text editing software for creative writing from Adobe USA. A security vulnerability exists in Adobe InCopy version 21.0, 19.5.5 and prior versions that originates from a heap-based buffer overflow and could lead to the execution of arbitrary code...

GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 跨站脚本漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A cross-site scripting vulnerability exists in GitLab Enterprise Edition EE and GitLab...

Security Bulletin: IBM Maximo Application Suite uses java 17.0.13,github.com/go-viper/mapstructure/v2 v2.2.1 and github.com/docker/docker v27.3.1 which is vulnerable to GHSA-2464-8j7c-4cjm,CVE-2025-21502 and CVE-2025-54410

Summary IBM Maximo Application Suite uses java 17.0.13,github.com/go-viper/mapstructure/v2 v2.2.1 and github.com/docker/docker v27.3.1 which is vulnerable to GHSA-2464-8j7c-4cjm,CVE-2025-21502 and CVE-2025-54410. This bulletin contains information regarding the vulnerability and its fixture...

EUVD-2026-0655

This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure...

SUSE CVE-2025-13357

Vault's Terraform Provider incorrectly set the default denynullbind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. Thi...

CVE-2025-65792

DataGear v5.5.0 is vulnerable to Arbitrary File Deletion...

CVE-2025-67472

Cross-Site Request Forgery CSRF vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through = 4.5.5...

EUVD-2025-202132

Cross-Site Request Forgery CSRF vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: from n/a through = 4.5.5...