golang: cmd/compile: no-op interface conversion bypasses overlap checking

A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data...

golang: golang.org/x/tools/gopls: gopls: Arbitrary code execution due to insecure network binding

A flaw was found in gopls. When started with -listen using a hostless address for example :8080 or with -port, the language server binds to 0.0.0.0 instead of localhost, exposing the debug interface to the local network and allowing arbitrary code execution by a malicious party on the same networ...

CVE-2026-5412 Juju CloudSpec API could leak senstive information

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privileged user to access sensitive credentials. This...

EUVD-2026-21332

OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting XSS vulnerability in the console because document.write is used unsafely, which is relevant in scenarios where administrators use the console web interface to view instance console logs...

CVE-2026-6028

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313b20191024. Impacted is the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely...

CVE-2026-5905

An incorrect security ui flaw was found in the Permissions component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=483899628...

CVE-2026-5899

An incorrect security ui flaw was found in the History Navigation component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=474817168...

CVE-2026-5898

An incorrect security ui flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=470295118...

CVE-2026-5891

An insufficient policy enforcement flaw was found in the browser UI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=487471101...

CVE-2026-5882

An incorrect security ui flaw was found in the Fullscreen component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=480993682...

CVE-2026-5880

An incorrect security ui flaw was found in the browser UI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=424995036...

CVE-2026-5878

An incorrect security ui flaw was found in the Blink component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=365089001...

CVE-2026-6029

Totolink A7100RU (firmware 7.4cu.2313_b20191024) is affected by a vulnerability in the CGI Handler file /cgi-bin/cstecgi.cgi, specifically the setVpnAccountCfg function. Manipulating the User argument leads to an OS command injection. The flaw can be exploited remotely, and public exploits exist ...

CVE-2026-6025

A vulnerability was identified in Totolink A7100RU 7.4cu.2313b20191024. This affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The...

CVE-2026-6028

CVE-2026-6028 affects Totolink A7100RU (version 7.4cu.2313_b20191024). The vulnerability lies in the CGI Handler function setPptpServerCfg within /cgi-bin/cstecgi.cgi, where manipulating the argument enable enables an OS command injection . The issue can be triggered remotely and the exploit has ...

CVE-2026-6026

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313b20191024. This vulnerability affects the function setPortalConfWeChat of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument enable results in os command injection. The attack can ...

CVE-2026-6014

CVE-2026-6014 affects D-Link DIR-513 devices (firmware 1.10) in the POST Request Handler’s formAdvanceSetup (/goform/formAdvanceSetup). The issue arises from manipulating the argument webpage, causing a buffer overflow. This can be exploited remotely and the exploit has been published. The adviso...

CVE-2026-2305

The AddFunc Head & Footer Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aFhfcheadcode, aFhfcbodycode, and aFhfcfootercode post meta values in all versions up to, and including, 2.3. This is due to the plugin outputting these meta values without any sanitization or...

EUVD-2026-21270

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313b20191024. This issue affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument telnetenabled results in os command injection. The attack is possible ...

CVE-2026-5479 wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag

In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSLEVPCipherFinal and related EVP cipher finalization functions fails to verify the authentication tag before returning plaintext to the caller. When an application uses the EVP API to perform ChaCha20-Poly1305 decryption,...