EUVD-2026-116550

Tanium addressed an improper output sanitization vulnerability in Discover...

PT-2026-136942

The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output...

PT-2026-137308

Islandora does not sufficiently check file update access when processing media source and derivative uploads. A user with permission to update media or create derivatives can submit a crafted request to overwrite files they are not authorized to modify, including private files. The Islandora Text...

CVE-2026-97397: easywpstuff: The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is…

The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output...

PT-2026-137152

CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16 t message length counters. Attackers can send near-65535-byte data sets and large templates to a...

CVE-2026-116648

Tanium addressed an improper output sanitization vulnerability in Discover...

CVE-2026-116648

Tanium addressed an improper output sanitization vulnerability in its Discover component. The flaw is associated with CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). The vulnerability could lead to a LOW availability impact according to the CVSS 3.1 score of 4.1 . Remediatio...

CVE-2026-116648 Tanium addressed an improper output sanitization vulnerability in Discover.

Tanium addressed an improper output sanitization vulnerability in Discover...

Improper Output Neutralization for Logs

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in the deserialize method of BaseGeometryWidget in django/contrib/gis/forms/widgets.py. A...

CVE-2026-121547

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname,...

mongofiles may disclose GridFS content to standard output through a stored filename

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...

CVE-2026-119672 mongofiles may disclose GridFS content to standard output through a stored filename

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...

CVE-2026-119672

The mongofiles component of MongoDB Database Tools (versions 3.1.4 through before 100.20.1) is vulnerable to information disclosure. The root cause is that mongofiles uses a database-stored GridFS filename as the output destination for get_id when the --local flag is omitted. An attacker capable ...

CVE-2026-121547 dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname,...

EUVD-2026-115892

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname,...

CVE-2026-121547

Canop dysk versions prior to 3.8.2 are vulnerable to a terminal escape sequence injection (CWE-150). The issue occurs because the application renders unsanitized mount metadata in table and CSV output . A local attacker can craft FUSE mounts containing ESC/OSC sequences within mount-point names o...

Improper Django output handling vulnerability

Versions prior to Django 6.1.3, 6.0.10, and 5.2.19 contain a vulnerability related to improper output handling. This issue arises because django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize fails to escape submitted invalid values before logging them, potentially allowing remote...

PT-2026-136681

Tanium addressed an improper output sanitization vulnerability in Discover...

CVE-2026-121547: Canop dysk: Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject…

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname,...

PT-2026-135852

A flaw was found in libslirp in if output. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-m nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...