CVE-2026-53585

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, gitdeltaapply in src/libgit2/delta.c trusts the attacker-controlled ressz value parsed by hdrsz from...

cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...

CVE-2026-53585 libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, gitdeltaapply in src/libgit2/delta.c trusts the attacker-controlled ressz value parsed by hdrsz from...

EUVD-2026-63548

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, gitdeltaapply in src/libgit2/delta.c trusts the attacker-controlled ressz value parsed by hdrsz from...

CVE-2026-53585 libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, gitdeltaapply in src/libgit2/delta.c trusts the attacker-controlled ressz value parsed by hdrsz from...

WordPress Saitama Addon Pack plugin <= 1.0.8 - Contributor+ Stored XSS via Post Meta vulnerability

Contributor+ Stored XSS via Post Meta vulnerability discovered by testoun in WordPress Plugin Saitama Addon Pack versions = 1.0.8...

CVE-2026-76220

GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypassed by combining a single-character kwarg with splitsinglecharoptions=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clonefrom to emit a joined toke...

Microsoft Support

Microsoft Support What do you need help with today? Microsoft Copilot Microsoft 365 Outlook OneDrive Microsoft Teams Windows Surface devices Gaming Microsoft account Microsoft Store More Microsoft products Start your Copilot journey here New to Copilot? Start with Chat Ask a question, draft...

EUVD-2026-60918

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-66633 WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Fluent Forms Pro Add On Pack versions 6.2.12...

PT-2026-77061

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-66633: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

Security Bulletin: IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information (CVE-2026-1014)

Summary A sensitive information disclosure vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2026-1014 DESCRIPTION: IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to exposure of sensitive information via JSON server respon...

Malicious code in abi-pack-framework (npm)

The package abi-pack-framework was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in @zalastax/nolb-dsr-pack (npm)

The package @zalastax/nolb-dsr-pack was found to contain malicious code. --- Credit: OpenSSF source...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: wasmcloud, kdash, zizmor, sccache, uv, pixi, rye, lychee, ntpd-rs, wasm-pack, deno, sqlx, nushell, atuin, wash, rustls-ffi, sdp-k8s-injector, shadowsocks-rust, rustup, cargo-audit, wadm, qdrant, parseable, linkerd2-proxy, buck2, oranda, tealdeer, zed, zola, wasmtime,...

io.zerows:zero-boot-actor (1.0.50), io.zerows:zero-boot-cloud-actor (1.0.50) +17 more potentially affected by CVE-2026-72645 via org.elasticsearch:elasticsearch (>=9.0.0, <=9.4.4)

org.elasticsearch:elasticsearch MAVEN version =9.0.0, =0.102.0, =9.4.0, =9.4.0, =9.0.0, =9.4.4 and more Source cves: CVE-2026-72645 Source advisory: MEND:CVE-2026-72645...

org.elasticsearch.plugin:x-pack-esql (9.5.0), org.elasticsearch.plugin:x-pack-esql-compute (9.5.0) +3 more potentially affected by CVE-2026-72645 via org.elasticsearch:elasticsearch (9.5.0)

org.elasticsearch:elasticsearch MAVEN version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch.plugin:x-pack-esql 9.5.0 - org.elasticsearch.plugin:x-pack-esql-compute 9.5.0 -...

org.elasticsearch.plugin:x-pack-esql (9.5.0), org.elasticsearch.plugin:x-pack-esql-compute (9.5.0) +3 more potentially affected by CVE-2026-72678 via org.elasticsearch:elasticsearch (9.5.0)

org.elasticsearch:elasticsearch MAVEN version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch.plugin:x-pack-esql 9.5.0 - org.elasticsearch.plugin:x-pack-esql-compute 9.5.0 -...