PT-2026-105812

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

CentOS Linux 8.5 [TuxCare] Security Update: perl / perl-Attribute-Handlers / perl-Devel-Peek / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1784303988)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1784303988 advisory. - Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular...

Rocky Linux 9.6 [TuxCare] Security Update: perl / perl-Attribute-Handlers / perl-AutoLoader / perl-AutoSplit / etc (ALMALINUX9.6:CLSA-2026:1787646574)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787646574 advisory. - Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in Smeasurestruct...

Rocky Linux 8.6 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc Multiple Vulnerabilities (ciqsa-2026_1017)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261017 advisory. This advisory aggregates security fixes for the dotnet6.0 SRPM in CIQ LTS 8.6. It addresses 4 CVEs: CVE-2024-43485, CVE-2024-43484, CVE-2024-43483,...

PT-2026-103732

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display name via /wp-admin/profile.php + bbp reply content via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This...

Linux Distros Unpatched Vulnerability : CVE-2026-102830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5....

AlmaLinux 9.2 [TuxCare] Security Update: perl / perl-Attribute-Handlers / perl-AutoLoader / perl-AutoSplit / etc (ALMALINUX9.2:CLSA-2026:1784531112)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784531112 advisory. - Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in Smeasurestruct leadi...

CVE-2026-102830

A flaw was found in JupyterLab. Incomplete validation of language pack headers allows arbitrary JavaScript code to be injected and executed during string translation. An attacker could exploit this flaw by enticing a user to load a malicious third-party language pack, resulting in code execution...

org.elasticsearch.plugin:x-pack-esql (>=9.5.0, <=9.5.2), org.elasticsearch.plugin:x-pack-esql-compute (>=9.5.0, <=9.5.2) +3 more potentially affected by CVE-2026-94408 via org.elasticsearch:elasticsearch (>=9.5.0, <=9.5.2)

org.elasticsearch:elasticsearch MAVEN version =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.2 Source cves: CVE-2026-94408 Source advisory: MEND:CVE-2026-94408...

org.elasticsearch.plugin:x-pack-esql (>=9.5.0, <=9.5.3), org.elasticsearch.plugin:x-pack-esql-compute (>=9.5.0, <=9.5.3) +4 more potentially affected by CVE-2026-94397 via org.elasticsearch:elasticsearch (>=9.5.0, <=9.5.3)

org.elasticsearch:elasticsearch MAVEN version =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.3 - pl.allegro.tech.elasticsearch.plugin:elasticsearch-analysis-morfologik 9.5.3 Source cves: CVE-2026-94397 Source advisory: MEND:CVE-2026-94397...

org.elasticsearch.plugin:x-pack-esql (>=9.5.0, <=9.5.3), org.elasticsearch.plugin:x-pack-esql-compute (>=9.5.0, <=9.5.3) +4 more potentially affected by CVE-2026-94396 via org.elasticsearch:elasticsearch (>=9.5.0, <=9.5.3)

org.elasticsearch:elasticsearch MAVEN version =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.3 - pl.allegro.tech.elasticsearch.plugin:elasticsearch-analysis-morfologik 9.5.3 Source cves: CVE-2026-94396 Source advisory: MEND:CVE-2026-94396...

org.elasticsearch.plugin:x-pack-esql (>=9.5.0, <=9.5.3), org.elasticsearch.plugin:x-pack-esql-compute (>=9.5.0, <=9.5.3) +4 more potentially affected by CVE-2026-94399 via org.elasticsearch:elasticsearch (>=9.5.0, <=9.5.3)

org.elasticsearch:elasticsearch MAVEN version =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.3 - pl.allegro.tech.elasticsearch.plugin:elasticsearch-analysis-morfologik 9.5.3 Source cves: CVE-2026-94399 Source advisory: MEND:CVE-2026-94399...

org.elasticsearch.plugin:x-pack-esql (>=9.5.0, <=9.5.3), org.elasticsearch.plugin:x-pack-esql-compute (>=9.5.0, <=9.5.3) +4 more potentially affected by CVE-2026-94398 via org.elasticsearch:elasticsearch (>=9.5.0, <=9.5.3)

org.elasticsearch:elasticsearch MAVEN version =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.3 - pl.allegro.tech.elasticsearch.plugin:elasticsearch-analysis-morfologik 9.5.3 Source cves: CVE-2026-94398 Source advisory: MEND:CVE-2026-94398...

org.elasticsearch.plugin:x-pack-esql (>=9.5.0, <=9.5.2), org.elasticsearch.plugin:x-pack-esql-compute (>=9.5.0, <=9.5.2) +3 more potentially affected by CVE-2026-82294 via org.elasticsearch:elasticsearch (>=9.5.0, <=9.5.2)

org.elasticsearch:elasticsearch MAVEN version =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.0, =9.5.2 Source cves: CVE-2026-82294 Source advisory: MEND:CVE-2026-82294...

CLEANSTART-2026-RQ22332 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames

Security vulnerability affects the loki package. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames...

ROOT-APP-PYPI-GHSA-6V7P-G79W-8964 GHSA-6v7p-g79w-8964 in msgpack - Patched by Root

Root has patched GHSA-6v7p-g79w-8964 in the msgpack package for Root:PyPI. Multiple fixed versions available...

[SECURITY] Fedora 45 Update: qmmp-plugin-pack-2.3.1-3.fc45

Plugin pack is a set of extra plugins for Qmmp. FFap - enhanced Monkey's Audio APE decoder 24-bit samples and embedded cue support FFVideo - video playback engine based on FFmpeg library Goom - audio visualization based on goom project MMS - MMS protocol support uses libmms library ModPlug - modu...

WordPress Element Pack Addons for Elementor plugin <= 8.7.14 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Element Pack Elementor Addons versions = 8.7.14...

CVE-2026-66574

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

CVE-2026-66574 WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...