CVE-2026-76610 Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

EUVD-2026-63237

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

CVE-2026-76610 Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

CVE-2026-76610

Zoo (a Joomla extension by YOOtheme ) versions prior to 4.1.65 contain an access control flaw in the comment controller endpoint . The endpoint lacked ACL checks, enabling unauthenticated users to modify tags remotely over the network with no user interaction required. The CVSS 4.0 base score is ...

PT-2026-80754

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

PT-2026-79006

Name of the Vulnerable Software and Affected Versions @cgauge/yaml npm package affected versions not specified Description An issue exists where attackers can execute arbitrary JavaScript by embedding a custom !js YAML tag. During document parsing, the construct callback unconditionally calls the...

CVE-2026-76833: Improper Neutralization of Directives in Dynamically Evaluated Code

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...

CVE-2026-76610: Cross-Site Request Forgery (CSRF)

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users...

External Control of File Name or Path

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to External Control of File Name or Path in the PDF export process. An attacker can access sensitive local files by embedding an tag with a src attribute...

External Control of File Name or Path

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to External Control of File Name or Path in the PDF export process. An attacker can access sensitive local files by embedding an tag with a src attribute...

MINI-WRC6-9CMQ-QH8G

Bulletin has no description...

MINI-WX7P-V34F-34WR

Bulletin has no description...

CVE-2026-70907

creationtimestamp| type| source ---|---|--- 2026-08-19 13:35:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtgtwox6lk2o...

vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

ImpactEdit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review PatchesNo WorkaroundsNo...

PYSEC-2026-3703 vantage6: Algorithm developer can edit another developer's algorithm that is pending / under review

Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review Patches No Workarounds No...

MINI-FCXP-52VQ-V6WQ

Bulletin has no description...

CVE-2026-15421

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15421

The Speed Optimizer WordPress plugin (versions ≤ 7.8.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) via image tag attributes in its Lazy Load Media feature. The root cause is insufficient input sanitization and output escaping in the lazy-load image processing code. An authenticated attac...

CVE-2026-15421 Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-62219

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...