PT-2026-63251

Name of the Vulnerable Software and Affected Versions Google Chrome on Linux versions prior to 150.0.7871.182 Description Insufficient validation of untrusted input within the Certificate component allows an attacker in a privileged network position to perform domain spoofing through the use of...

WordPress Core SQL Injection Vulnerability

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations...

@astrojs/rss: XML Injection via Unescaped RSS Feed Fields

Summary In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS...

Improper Encoding or Escaping of Output

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the transition:persist, transition:scope, or transition:persist-props directives when...

GHSA-7PW4-F3Q4-R2P2 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Summary When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these...

EUVD-2026-44392

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability...

node-tar: Decompression/parse DoS via unlimited input

Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...

NPM: node-tar: Decompression/parse DoS via unlimited input

NPM: node-tar: Decompression/parse DoS via unlimited input vulnerability discovered by ? in WordPress Npm tar versions = 7.5.18...

EUVD-2026-39180

shell-quote: Quadratic-complexity Denial of Service in parse CWE-407...

DEBIAN-CVE-2026-58624

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

CVE-2026-58624

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

EUVD-2026-46101

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

CVE-2026-58624 Apache MINA SSHD: Remote execution of JGit commands can write files on the server

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

CVE-2026-58624

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash

A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger an out-of-bounds write due to improper input validation, resulting in an unexpected process crash...

webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox

A flaw was found in WebKitGTK. A malicious website can process restricted web content outside the sandbox due to improper input validation, potentially allowing access to resources that should be restricted...

MGASA-2026-0276 Updated golang packages fix security vulnerabilities

The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...

GHSA-PR2V-JX2C-WG9F Tornado vulnerable to Header Injection and XSS via reason argument

Header injection and XSS via reason argument Summary The reason argument used by both RequestHandler.setstatus and tornado.web.HTTPError is designed to allow applications to pass custom "reason" phrases the "Not Found" in HTTP/1.1 404 Not Found to the HTTP status line mainly for non-standard stat...

dotnet: .NET Framework: Denial of Service via improper input validation

A flaw was found in .NET Framework. This improper validation of input allows an unauthorized attacker to remotely deny service over a network. This vulnerability can lead to a Denial of Service DoS condition, making the affected system unavailable to legitimate users...