EUVD-2026-60193

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

CVE-2026-75004

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesievedisabledactions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...

CVE-2026-75004

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesievedisabledactions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin...

CVE-2026-75004

In Roundcube Webmail, improper rule name quoting in the managesieve plugin allows a crafted Sieve rule name to bypass the managesieve_disabled_actions setting, letting users re-enable restricted Sieve actions (e.g., redirect, discard). Affects Roundcube <1.6.18 and 1.7.x

Exploit for CVE-2026-59310

cve-id Donate Support the maintenance of this project wit...

CVE-2026-65914

A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting XSS, occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like script or iframe. An attacker can craft malicious input that, during...

CVE-2026-73075

A flaw was found in Vim, an open-source text editor. This vulnerability involves an out-of-bounds memory access within the popup opacity handling feature. A local attacker could exploit this by using specially crafted Vim script, leading to an out-of-bounds read and a limited out-of-bounds write...

CVE-2026-19971

A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this...

CVE-2026-67961

O2OA v10.0.2 is vulnerable: a local attacker with low privileges can execute arbitrary code by bypassing the sandbox mechanism of the Invoke script execution. CVSS 7.8 (High) reflects full confidentiality, integrity, and availability impact. PT Security confirms no fixed version is available yet....

PT-2026-76873

Name of the Vulnerable Software and Affected Versions O2OA version 10.0.2 Description A local attacker can execute arbitrary code by exploiting the sandbox mechanism used during the execution of the Invoke script. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-67961

An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution...

CVE-2026-67961

An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution...

EUVD-2026-59923

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'btbbshortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2026-2357 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'btbbshortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2026-16775

The affected software is the Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin. Affected versions: all versions up to and including 4.9.0. Vulnerability type: Stored Cross-Site Scripting via the 'id' Shortcode Attribute, caused by insufficient input sanitization and output...

PT-2026-73080

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'question title' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

Exploit for CVE-2026-9830

CVE-2026-9830 BookingPress Pro API Assessment PoC This reposi...

MAL-2026-14067 Malicious code in upload-to-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590 [email protected] runs a postinstall lifecycle script on npm install that collects host identifiers os.hostname, process.platform, process.arch, No...

Malicious code in fastly-vcl-language-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...

dracut security update

An update is available for dracut. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The dracut packages contain an event-driven initial RAM file system initramfs...