MAL-2026-13618 Malicious code in w-screenctl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b2f241eacc2eaaaac28d2b9d76aeb67042a109869b28e45a88648bf937f856f When WScreenctl is invoked via the bundled g.mjs entry or the documented systemd/Task Scheduler service units, the package starts a Hapi HTTP server...

K000162842: wolfSSL vulnerability CVE-2026-55961

Security Advisory Description wolfSSLPKCS7verify returning success for a degenerate certs-only PKCS7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path no...

CVE-2026-62992

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 5.8.2 and 4.5.7 on the 4.x line, Security::checkDir does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. A...

CVE-2026-0673

creationtimestamp| type| source ---|---|--- 2026-08-07 08:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msi4h62psp2r...

EUVD-2026-54378

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected...

CVE-2026-12801 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-12801

The CVE-2026-12801 entry concerns the Ultra Addons for Contact Form 7 plugin (WordPress). Affected: all versions up to and including 3.5.43. Vulnerability: Stored Cross-Site Scripting via the Range Slider attributes data-label and data-separator, caused by insufficient input sanitization and insu...

CVE-2026-12801

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-12801 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

WordPress < 7.0.3 - SSRF vulnerability

SSRF vulnerability discovered by Andrew Mohawk in WordPress core versions 7.0.3...

WordPress < 7.0.3 - CSS Injection vulnerability

CSS Injection vulnerability discovered by Anthropic in WordPress core versions 7.0.3...

WordPress < 7.0.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Elio Gubser in WordPress core versions 7.0.3...

EUVD-2026-54275

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's databasebackup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single fullresto...

Apple Security Advisory 07-27-2026-3

Apple Security Advisory 07-27-2026-3 - macOS Sequoia 15.7.8 addresses buffer overflow, bypass, code execution, denial of service, double free, heap corruption, information leakage, integer overflow, out of bounds read, out of bounds write, traversal, and use-after-free vulnerabilities...

Fedora 43 : abrt (2026-cccf5985b5)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cccf5985b5 advisory. Update to 2.17.9 Resolves: 2484614 Resolves: CVE-2026-54230 Resolves: CVE-2026-54231 Resolves: CVE-2026-54228 Resolves: CVE-2026-54229 Tenable has...

Wordpress < 7.0.3 - Unauthenticated Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure vulnerability discovered by Ehtisham Siddiqui in WordPress core versions 7.0-7.0.2...

CVE-2026-53983

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-45378

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...

EUVD-2026-51620

Contao: Possible path traversal in job download URIs...

NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS

NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS vulnerability discovered by ? in WordPress Npm mermaid versions = 10.6.0, 10.9.8...