QUIC-TRIP: A Triple-Redundant Journey toward Secure Substation Communications

Modern power systems rely on real-time substation communication protocols, such as the Routable Generic Object-Oriented Substation Event R-GOOSE, for critical control and protection functions. However, these protocols often lack built-in security features and prioritize availability over...

PT-2026-65397

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the process bulk action function. This makes it possible for unauthenticate...

CVE-2026-48060: Improper Neutralization of Input During Web Page Generation

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: xfrm: Duplicate SPI Handling CVE-2025-39797 kernel: lib/buildid: use kernelread for sleepable context CVE-2026-23002 kernel: futex: Drop CLONETHREAD requirement for private default hash...

Oracle Linux 10 : kernel (ELSA-2026-21557)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-21557 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

CVE-2026-65437

Unauthenticated Cross Site Scripting XSS in Spam protection, AntiSpam, FireWall by CleanTalk = 6.82 versions...

CVE-2026-65437 WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Spam protection, AntiSpam, FireWall by CleanTalk = 6.82 versions...

CVE-2026-65437

Unauthenticated Cross Site Scripting XSS in Spam protection, AntiSpam, FireWall by CleanTalk = 6.82 versions...

CVE-2026-43796

This issue was addressed with improved data protection. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read a persistent device identifier...

CVE-2026-64733

This issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user...

EUVD-2026-49515

This issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user...

CVE-2026-64733

This vulnerability affects multiple Apple operating systems, including iOS 26.6 , iPadOS 26.6 , macOS Tahoe 26.6 , tvOS 26.6 , visionOS 26.6 , and watchOS 26.6 . The root cause involves a lack of sufficient data protection, which could allow an application to fingerprint the user . Apple has addr...

CVE-2026-64733

This issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user...

CVE-2026-43796

An app may be able to read a persistent device identifier due to insufficient data protection. This vulnerability affects multiple Apple platforms, including iOS 18.7.10 , iPadOS 18.7.10 , iOS 26.6 , iPadOS 26.6 , macOS Sequoia 15.7.8 , macOS Sonoma 14.8.8 , macOS Tahoe 26.6 , tvOS 26.6 , visionO...

EUVD-2026-49486

This issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data...

CVE-2026-43796

This issue was addressed with improved data protection. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read a persistent device identifier...

CVE-2026-43796

This issue was addressed with improved data protection. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read a persistent device identifier...

CVE-2026-64537 bridge: cfm: reject invalid CCM interval at configuration time

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: reject invalid CCM interval at configuration time ccmtxworkexpired re-arms itself via queuedelayedwork using the configured expinterval converted by intervaltous. When expinterval is BRCFMCCMINTERVALNONE or out of...

pingap v0.13.7

pingap Before the pingap version is stable, no pull requests will be accepted. If you have any questions, please create a new issue first. Overview Pingap is a high-performance reverse proxy powered by the Cloudflare Pingora . It simplifies operational management by enabling dynamic, zero-downtim...

CVE-2026-66391

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...