CVE-2026-57532: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering...

CVE-2026-56006: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in H5P = 1.17.6 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-53052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: qcom: qdsp6: topology: check widget type before accessing data Check widget type before accessing the private data, as this could a virtual widget which i...

CVE-2026-13350: Authorization Bypass Through User-Controlled Key

Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create...

CVE-2026-40211: Allocation of Resources Without Limits or Throttling

An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buffer from being freed right away. The buffer will be freed at the end of the QUIC connection, but on some setups it might be possible to open enough concurrent DoH3 streams to trigger an out-of-memo...

CVE-2026-54838: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in WC Vendors Marketplace = 2.6.8 versions...

CVE-2026-7511: Improper Verification of Cryptographic Signature

PKCS7verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bound, permitting a forged signature to be accepted...

CVE-2026-55967: Reusing a Nonce, Key Pair in Encryption

AES-GCM encryption/decryption with extremely large cumulative single message sizes 64 GiB were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery...

CVE-2026-10592: Improper Certificate Validation

Certificates with wildcard DNS SANs e.g. .example.com bypassed CA name-constraint checks. A certificate with a wildcard DNS SAN that should be rejected by the issuing CA's permitted/excluded DNS name constraints could be accepted...

CVE-2026-12340: Out-of-bounds Read

Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier computation reads the trailing 65 bytes of the public key without checking that the key is at least that long. A public key shorter than 65...

io.jenkins.plugins:secone-sca-sast-security-scanner (>=13.v31f269d5b_52f, <=45.v14200f5b_4b_33), org.6wind.jenkins:lockable-resources (1301.v0e3b_da_4b_4462) +5 more potentially affected by CVE-2026-57280 via org.jenkins-ci.plugins:script-security (1354.va_70a_fe478c7f)

org.jenkins-ci.plugins:script-security MAVEN version 1354.va70afe478c7f is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - io.jenkins.plugins:secone-sca-sast-security-scanner =13.v31f269d5b52f,...

Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild

We measure an automation-based supply chain campaign in the Go ecosystem. The attackers repackage legitimate Go modules under attacker-controlled owners, and embed them with obfuscated code for an import-triggered downloader. Our results come from two complementary analyses: a a manual search on...

CVE-2026-57299: Missing Authorization

Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata...

CVE-2026-57301: Externally Controlled Reference to a Resource in Another Sphere

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller...

CVE-2026-11878: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in OpenText Access Manager allows Cross-Site Scripting XSS. This issue affects Access Manager: from 5.1 through 5.1.2...

CyberSentinel-Pro-Web-Vulnerability-Scanner

CyberSentinel Pro CyberSentinel Pro is a web vulnerability sc...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: ctop, kubevela, helm-operator, kots, tigera-operator, zarf, syft-fips, wolfictl, neuvector, jfrog-cli, k3s, zot, beats-fips, grype, headlamp, steampipe, kgateway-fips, google-osconfig-agent, amazon-ecs-agent-fips, helm-mapkubeapis, tekton-pipelines, helmfile,...

GHSA-CVXM-645Q-P574 vulnerabilities

Vulnerabilities for packages: ctop, kubevela, helm-operator, kots, tigera-operator, zarf, syft-fips, wolfictl, neuvector, jfrog-cli, k3s, zot, beats-fips, grype, headlamp, steampipe, kgateway-fips, google-osconfig-agent, amazon-ecs-agent-fips, helm-mapkubeapis, tekton-pipelines, helmfile,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: ctop, kubevela, helm-operator, kots, tigera-operator, zarf, syft-fips, wolfictl, neuvector, jfrog-cli, k3s, zot, grype, headlamp, steampipe, kgateway-fips, google-osconfig-agent, amazon-ecs-agent-fips, helm-mapkubeapis, helmfile, gitlab-rails-ce, helm-exporter,...

GHSA-JPCC-P29G-P8MQ vulnerabilities

Vulnerabilities for packages: ctop, kubevela, helm-operator, kots, tigera-operator, zarf, syft-fips, wolfictl, neuvector, jfrog-cli, k3s, zot, grype, headlamp, steampipe, kgateway-fips, google-osconfig-agent, amazon-ecs-agent-fips, helm-mapkubeapis, helmfile, gitlab-rails-ce, helm-exporter,...