AZL-97053 CVE-2026-74612 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-3424

The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 5.4.10.3 . The root cause is improper validation of the payload parameter before passing it to do_shortcode, allowing an...

EUVD-2026-64250

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value befo...

CVE-2026-3424 kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value befo...

CVE-2026-3424 kk Star Ratings <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value befo...

EUVD-2026-64248

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

CVE-2026-66917

JoomGallery (a Joomla extension) versions prior to 4.3.1 are affected by a Stored Cross-Site Scripting (XSS) vulnerability. An authenticated user with privileged access can embed an XSS payload in any image, resulting in JavaScript execution in the browser of every visitor who views the affected ...

CVE-2026-66917 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

CVE-2026-66917 Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

SUSE CVE-2026-18299

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...

PT-2026-79527

Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser...

PT-2026-79530

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value befo...

CVE-2026-3424: Improper Control of Generation of Code

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value befo...

CVE-2026-18299

A flaw was found in GStreamer. This use-after-free vulnerability in the rtpsbcdepay element, specifically during the processing of Real-time Transport Protocol RTP payload elements, allows a remote attacker to execute arbitrary code. The issue arises from a lack of validation for an object's...

CVE-2026-54682

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render i...

CVE-2026-54682

DiscordChatExporter prior to 2.47.2 is vulnerable to a stored XSS in its HTML export feature. When markdown formatting is disabled, attacker-controlled content from Discord messages and embeds is rendered through FormatMarkdownAsync and FormatEmbedMarkdownAsync in MessageGroupTemplate.cshtml with...

Linux Distros Unpatched Vulnerability : CVE-2026-18299

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

CVE-2026-18420

Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...

CVE-2026-18420 RCE via Prototype Pollution in OpenSearch Dashboards

Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...

CVE-2026-18420 RCE via Prototype Pollution in OpenSearch Dashboards

Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...