CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...

CVE-2026-47755

CVE-2026-47755 : ITFlow prior to v26.05 is vulnerable to authenticated cross-tenant credential disclosure. A low-privileged authenticated agent can fetch plaintext credentials and TOTP secrets of another client by loading the credential edit modal for an arbitrary credential_id due to missing cli...

GHSA-5XF7-4P34-54QR pypdf: Possible infinite loop for not terminated inline images

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page with a not terminated inline image, as done when extracting the page text for example. Patches This has been fixed in pypdf==6.14.1. Workarounds If yo...

SUSE-SU-2026:22938-1 Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: - Version 1.3.6: Various integration test improvements. When masking directories...

CVE-2026-65481

Contributor Local File Inclusion in Vino = 1.9 versions...

CVE-2026-65486

Unauthenticated Broken Access Control in Event post = 6.0.1 versions...

CVE-2026-65466

Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...

CVE-2026-65460

Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...

CVE-2026-57370

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.9.1 versions...

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

SummaryPillow's TGA RLE encoder reads past its row buffer when saving a mode "1"image. Adjacent process heap bytes can be copied into the generated TGA file.The bug is reachable through the public save API:pythonim.saveout, format="TGA", compression="tgarle"Older affected Pillow versions use the...

PYSEC-2026-3494 Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Summary Pillow's TGA RLE encoder reads past its row buffer when saving a mode "1" image. Adjacent process heap bytes can be copied into the generated TGA file. The bug is reachable through the public save API: python im.saveout, format="TGA", compression="tgarle" Older affected Pillow versions us...

EUVD-2026-48141

Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...

CVE-2026-65535

Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...

CVE-2026-65535 WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability

Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...

EUVD-2026-48134

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

EUVD-2026-48130

Unauthenticated Broken Access Control in Graphina = 3.1.12 versions...

CVE-2026-65524 WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...

CVE-2026-65501 WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

EUVD-2026-48092

Contributor Local File Inclusion in Vino = 1.9 versions...

CVE-2026-65480 WordPress TheGem theme < 5.12.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1...