PT-2026-90856

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the snd ctl ascii elem id parse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or...

CVE-2026-90489 Xuxueli xxl-job insert cross site scripting

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVE-2026-90489 Xuxueli xxl-job insert cross site scripting

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVE-2026-90489

Xuxueli xxl-job up to 3.5.0 contains a cross-site scripting (XSS) vulnerability in the /jobinfo/insert endpoint. Manipulating the name or author arguments allows remote attackers with low privileges (requiring user interaction) to inject client-side scripts. The CVSS 3.1 base score is 3.5 (LOW) ,...

CVE-2026-77161

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-77161

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to SQL Injection via Parameter Name in all versions up to and including 5.1.24 . The root cause is insufficient escaping on a user-supplied parameter and lack of sufficient preparation of the existing SQL query, allo...

EUVD-2026-76835

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-77161 Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-77161 Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

PT-2026-90595

The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-90534: Authorization Bypass Through User-Controlled Key

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

Fedora 45 : libmongocrypt (2026-0664f1b41b)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0664f1b41b advisory. Version 1.20.4 Fixed - Reject undersized decryption payloads. CVE-2026-84971 ---- Version 1.20.3 Fixed - Validate database and collection name...

CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

EUVD-2026-76695

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165

Dobase , an open-source self-hosted workspace, is affected by a one-click stored DOM-based XSS in its public shared-folder image gallery. The root cause is that a file's name attribute is fully attacker-controlled and never sanitized; it is round-tripped through an ERB-escaped data-name attribute...

CVE-2026-89652

CVE-2026-89652 is a slab out-of-bounds write in the Linux kernel's Ceph filesystem (cephfs). The functions ceph_get_name() and __get_snap_name() copy an MDS-supplied dentry name into a NAME_MAX-sized buffer via memcpy without validating the length, allowing a malicious or buggy Ceph MDS to overfl...

CVE-2026-81008

CVE-2026-81008 is a slab use-after-free in the Linux kernel's interconnect subsystem, affecting icc_get() and of_icc_get_by_index(). When kasprintf() fails to allocate path-&gt;name, the error path calls kfree(path) directly, leaving dangling pointers in the req_list hlists that were already popu...

[SECURITY] Fedora 45 Update: nsd-4.15.1-1.fc45

NSD is a complete implementation of an authoritative DNS name server. For further information about what NSD is and what NSD is not please consult the REQUIREMENTS document which is a part of this distribution...

DEBIAN-CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...