Giga Messenger WordPress - Cross-Site Scripting

Giga Messenger WordPress plugin = 2.3.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

Joplin 3.3.3 Server - Privilege Escalation

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/-id t...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: Atom Integrated System Info v22 for DCN35 A new request from KMD/VBIOS is to support a new UMA carveout model. This resolves a null dereference issue when accessing Ctx-dcbios-integratedinfo, as this variable...

Astra Linux – Vulnerability in WebKit2GTK

A port redirection issue has been resolved with additional port validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4, and iPadOS 14.4, as well as Safari 14.0.3. A malicious website may be able t...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB before version 10.6.5 has a sqllex.cc integer overflow issue, which can lead to an application crash...

Astra Linux – Vulnerability in gpac

NULL pointer dereferencing in the GitHub repository gpac/gpac before 2.3-DEV...

Astra Linux – Vulnerability in Thunderbird

Ribose RNP before version 0.16.3 may hang when the input is malformed...

CVE-2026-18478

Magnolia CMS is affected by a Stored XSS in the import functionality (CVE-2026-18478). An attacker with editor privileges can inject arbitrary HTML/JavaScript into the name of an uploaded image, which is rendered/executed when the image is opened. The issue is fixed in Magnolia CMS version 6.3.10...

CVE-2026-18464

The WP MAPS PRO WordPress plugin (versions before 6.1.3 ) is vulnerable to a Denial of Service (DoS) attack due to uncontrolled resource consumption (CWE-400 ). The root cause is an AJAX action accessible to unauthenticated users that lacks a proper capability check and fails to restrict the disp...

Security Bulletin: Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path

Summary Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can...

CVE-2026-66685

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...

CVE-2026-66706

CVE-2026-66706 affects the WordPress plugin “Subscribe to Comments” (versions

CVE-2026-66706

Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...

EUVD-2026-53909

Author Cross Site Scripting XSS in Subscribe to Comments = 2.3.1 versions...

CVE-2026-66685

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

CVE-2026-65565

Unauthenticated Cross Site Scripting XSS in Survey Maker = 5.2.3.3 versions...

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...

CLSA-2026-1785954263 TuxCare security update for org.springframework (9 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 9 CVEs. Fixed in 5.3.37-tuxcare.9...

EUVD-2026-53341

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...