CVE-2026-8042 Github Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribute in the 'github' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

go-git security vulnerabilities

go-git is an open-source, highly scalable Git implementation written entirely in Go. Versions of go-git prior to 5.19.1 and 6.0.0-alpha.4 contained security vulnerabilities. These vulnerabilities stemmed from the use of SSH for transmitting commands remotely; the repository path was enclosed in...

CVE-2026-44971: Server-Side Request Forgery (SSRF)

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

Free5GC code-related vulnerabilities

free5GC is an open-source project for the 5th generation 5G mobile core network. Versions of free5GC prior to 4.2.2 contained code vulnerabilities. These vulnerabilities stemmed from the NEF patch handler’s inability to handle UDR calls properly, leading to null pointer dereferencing and...

go-git path traversal vulnerability

go-git is an open-source, highly scalable Git implementation written entirely in Go. Versions of go-git prior to 5.19.1 and 6.0.0-alpha.4 contained a path traversal vulnerability. This vulnerability stemmed from path validation issues, which could allow malicious data from a specially crafted...

CVE-2026-45571: Improper Limitation of a Pathname to a Restricted Directory

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were...

free5GC security vulnerabilities

free5GC is an open-source project for the 5th generation 5G mobile core network. Versions of free5GC prior to 4.2.2 contained security vulnerabilities. These vulnerabilities stemmed from the PCF’s HandleCreateSmPolicyRequest handler, which encountered a null pointer dereferencing when UDR returne...

GHSA-VGWR-23FQ-PR7G XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

Impact A potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write arbitrary files. While the consequences could be severe like overriding configuration files and setting the superadmin password, the attack first requir...

org.xwiki.commons:xwiki-commons-extension-api (>=17.0.0-rc-1, <=17.4.8), org.xwiki.commons:xwiki-commons-extension-handler-jar (>=17.0.0-rc-1, <=17.4.8) +9 more potentially affected by CVE-2026-23734 via org.xwiki.commons:xwiki-commons-classloader-api (>=17.0.0-rc-1, <=17.4.8)

org.xwiki.commons:xwiki-commons-classloader-api MAVEN version =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.0.0-rc-1, =17.4.8 Source cves: CVE-2026-23734 Source advisory:...

org.xwiki.commons:xwiki-commons-extension-api (>=17.5.0, <=17.10.2), org.xwiki.commons:xwiki-commons-extension-handler-jar (>=17.5.0, <=17.10.2) +10 more potentially affected by CVE-2026-23734 via org.xwiki.commons:xwiki-commons-classloader-api (>=17.5.0, <=17.10.2)

org.xwiki.commons:xwiki-commons-classloader-api MAVEN version =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.5.0, =17.10.0-rc-1, =17.5.0, =17.10.2 Source cves: CVE-2026-23734 Source advisory: OSV:GHSA-XQ3R-2QV5-VQQM...

org.xwiki.commons:xwiki-commons-extension-api (>=18.0.0-rc-1, <=18.0.1), org.xwiki.commons:xwiki-commons-extension-handler-jar (>=18.0.0-rc-1, <=18.0.1) +10 more potentially affected by CVE-2026-23734 via org.xwiki.commons:xwiki-commons-classloader-api (>=18.0.0-rc-1, <=18.0.1)

org.xwiki.commons:xwiki-commons-classloader-api MAVEN version =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.0-rc-1, =18.0.1 Source cves: CVE-2026-23734 Source advisory:...

GHSA-HFPV-MC5V-P9MM Weblate has a Server-Side Request Forgery issue

Impact The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, the repository URL field is not validated or sanitized, allowing an attacker to supply...

EUVD-2025-203462

Weblate has a Server-Side Request Forgery issue...

Server-side Request Forgery (SSRF)

Overview weblate is an A web-based continuous localization system with tight version control integration Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the Create Component process. An attacker can access internal network resources and enumerate local fil...

GHSA-PG32-686Q-QH6X Apache CXF has an LDAP injection vulnerability

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

Apache CXF has an LDAP injection vulnerability

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

SUSE-SU-2026:21851-1 Security update for docker-stable

This update for docker-stable fixes the following issues - CVE-2026-33747: github.com/moby/buildkit: malicious frontends can craft API messages that cause files to be written outside of the BuildKit state directory bsc1260967. - CVE-2026-33748: github.com/moby/buildkit: insufficient validation of...

MAL-2026-4803 Malicious code in @fhkry/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75b00f1cbf8b88a31654d13fe812fd9201f0b0c92f9ddad31fea59376752a636 This package is a Baileys WhatsApp Web library fork that, on every WebSocket connection, silently performs WhatsApp newsletter actions on the...

Anonymous YARA Rules Are Not Anonymous

YARA rules are widely shared across threat intelligence communities to enable collective defence against malware. This practice implicitly assumes that removing metadata e.g., author fields sufficiently protects the identity of contributing organisations. To assess the validity of this assumption...

Batch Me If You Can: Coverage-Guided RPKI Fuzzing at Scale

The Resource Public Key Infrastructure RPKI has become essential to secure inter-domain routing. Despite its critical role, RPKI software remains largely untested beyond shallow parsing. Existing fuzzers, like AFL++ or libFuzzer, do not work well for RPKI as they assume a single, self-contained...