CVE-2026-69127 Kirby: System path exposure from error messages in the REST API

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

Malicious code in @aster110/cc2wechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...

MAL-2026-13520 Malicious code in @aster110/cc2wechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...

EUVD-2026-54451

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

CVE-2026-15816 Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

CPDLC over ATN-B1 Vulnerabilities

ADVISORY SUMMARY ATN-B1 CPDLC relies on legacy clear text unauthenticated radio frequency links. Research demonstrates that these characteristics allow unauthorized message injection, denial-of-service conditions, and forced session resets. These vulnerabilities do not constitute an unsafe...

EUVD-2026-54194

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

PT-2026-69100

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.5 Kirby versions 5.0.0 through 5.5.1 Description The REST API error handler can return unsanitized PHP error messages, which allows unauthenticated users to view the full filesystem path of the installation. This...

SUSE SLES15: rsyslog / rsyslog-module-gssapi / rsyslog-module-gtls / etc (SUSE-SU-2026:3518-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3518-1 advisory. - CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite bsc1272414. - input sequence during oversize-frame...

CVE-2025-71409: Missing Authentication for Critical Function

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency...

MAL-2026-13480 Malicious code in @prototypevip/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b0068015e90b8e47dd9b67c66ed1d0b0cc4c1ebccd985f08efd31837d27ce8 @prototypevip/baileys is a fork of the Baileys WhatsApp library. lib/Store/prototype-store.js registers a listener on the 'messages.upsert' event tha...

MAL-2026-13482 Malicious code in diezyclutch-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b034105b4e65e2ff38eef557d7b480758070d1122aa6338a6873a9ee76f9111a diezyclutch-baileys is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js the code constructs a network destination from a...

CVE-2026-71447

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

CVE-2026-71447 Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

CVE-2026-71447

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

CVE-2026-71447

CVE-2026-71447 : In the AIL Project (ail-framework), translation controls for chat messages and forum posts store identifiers into inline JavaScript onclick handlers without safe encoding for JS string literals. Although escaping is applied for HTML, the values can terminate the string argument, ...

CVE-2026-71447 Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

CVE-2026-71447 Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

Security update for rsyslog

This update for rsyslog fixes the following issues: CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite bsc1272414. Input sequence during oversize-frame recovery in imptcp can cause denial of service bsc1271910. Patch Instructions: To install this SUSE update u...