CVE-2026-85016 Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

CVE-2026-85016 Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...

CLEANSTART-2026-ED72933 html

Security vulnerability affects the consul package. The html...

CLEANSTART-2026-IF71348 When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

Security vulnerability affects the consul package. When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh...

CLEANSTART-2026-RW00799 Security fix for GHSA-f6x5-jh6r-wrfv applied in: consul 1.21.5-r0

Security vulnerability affects the consul package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JS43220 Security fix for GHSA-78h2-9frx-2jm8 applied in: consul 1.21.5-r1

Security vulnerability affects the consul package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PU41775 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

CVE-2026-34986 affects multiple packages. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references for individual vulnerability...

CLEANSTART-2026-ZL19560 Security fix for GHSA-9h8m-3fm2-qjrq applied in: consul 1.21.5-r0

Security vulnerability affects the consul package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-YM37209 Security fix for GHSA-4f99-4q7p-p3gh applied in: consul 1.20.6-r0, consul 1.21.5-r0

GHSA-4f99-4q7p-p3gh affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MD19554 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

Security vulnerability affects the consul package. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it...

CLEANSTART-2026-BX44757 For certain crafted inputs, a 'ed25519

Security vulnerability affects the consul package. For certain crafted inputs, a 'ed25519...

CLEANSTART-2026-NY69031 norm

CVE-2026-56852 affects multiple packages. A norm. See references for individual vulnerability details...

CLEANSTART-2026-NY71627 HashiCorp memberlist before version 0

CVE-2026-14362 affects multiple packages. HashiCorp memberlist before version 0. See references for individual vulnerability details...

CLEANSTART-2026-SM16447 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

CVE-2026-56853 affects multiple packages. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. See references for individual vulnerability details...

CLEANSTART-2026-SE64937 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

CLEANSTART-2026-YE69312 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CLEANSTART-2026-MT59352 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...

CLEANSTART-2026-JQ09832 gRPC-Go is the Go language implementation of gRPC

CVE-2026-84445 affects multiple packages. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

PT-2026-104324

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.25.0 Description The protocol skip routine in several Apache Thrift bindings fails to apply the recursion limit. This allows a message containing deeply nested unknown fields to exhaust the stack, potentially...

CVE-2026-66858: Uncontrolled Recursion

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...