CVE-2026-17577 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

CVE-2026-17577 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

CVE-2026-17577

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 4.7.42 . The flaw exists in the ssl_zen_messages::getMessages() function, which processes the uri and host parameters. Because the application uses base64_decode() on the output ...

EUVD-2026-86593

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

Malicious code in @alphaspace/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...

MAL-2026-17169 Malicious code in @alphaspace/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...

OESA-2026-4082 docker security update

Security Fixes: Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or...

OESA-2026-4074 flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the...

PT-2026-98870

Name of the Vulnerable Software and Affected Versions Google gVisor versions prior to commit 573a9e73cf844f Description An improper exposure of resource to the wrong sphere exists in the host file helper gofer on Linux platforms with CUSE Character device for Userspace enabled. A local attacker...

CVE-2026-93834: Use After Free

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

Linux Distros Unpatched Vulnerability : CVE-2026-96748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an...

PT-2026-98383

Name of the Vulnerable Software and Affected Versions SSL Zen plugin for WordPress versions prior to 4.7.43 Description Reflected Cross-Site Scripting occurs when unauthenticated attackers trick users into clicking specially crafted links to inject arbitrary web scripts. The issue exists because...

CVE-2026-17577: Improper Neutralization of Input During Web Page Generation

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

PT-2026-98851

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description A use-after-free issue exists in the 9pfs subsystem. A race condition occurs between the main thread and a worker thread during the concurrent processing of Tlcreate and Twalk requests. This...

Security update for gitoxide (moderate)

openSUSE security update: security update for gitoxide ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21955-1 Rating: moderate References: bsc1281749 Cross-References: CVE-2026-91986 CVSS scores: CVE-2026-91986 SUSE : 5.4...

CVE-2026-96812: Exposure of Resource to Wrong Sphere

Improper Exposure of Resource to Wrong Sphere in the host file helper gofer in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with CUSE enabled allows a local attacker with container image deployment privileges to achieve root code execution on the host system. By including a...

Suricata 8.0.4 < 8.0.7 Use-After-Free (CVE-2026-94084)

The version of OISF Suricata installed on the remote host is 8.0.4 or later but prior to 8.0.7. It is, therefore, affected by a vulnerability: - Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.responseheader with and without a...

Linux Distros Unpatched Vulnerability : CVE-2026-97550

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards --...

Linux Distros Unpatched Vulnerability : CVE-2026-97529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Validate BSG requestlen before reading vendorcmd The FC BSG transport allocates job-request via memdupuser using the exact user-supplied...

Linux Distros Unpatched Vulnerability : CVE-2026-97598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash...