PT-2026-80674

Impact Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review Patches No Workarounds No...

CVE-2026-15421: Improper Neutralization of Input During Web Page Generation

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-62585

creationtimestamp| type| source ---|---|--- 2026-08-18 22:16:06+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfakxt6d62p 2026-08-19 03:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtfsodtig22j 2026-08-19 17:45:41+00:00| seen|...

CVE-2026-73876

...

SUSE CVE-2026-72085

In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsibackgetpendreq obtains a command tag and returns a vscsibkpend whose embedded secmd has only been memset to 0, so its cmdkref is 0; the secmd is...

@rhinostone/swig: arbitrary local file read via include/extends path traversal

Overview @rhinostone/swig is a maintained fork of the abandoned swig template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The % include %, % extends %, and % import % tags resolve their target path through the filesystem...

GHSA-2MF3-MR2R-R4VF @rhinostone/swig: arbitrary local file read via include/extends path traversal

Overview @rhinostone/swig is a maintained fork of the abandoned swig template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The % include %, % extends %, and % import % tags resolve their target path through the filesystem...

CVE-2026-66633

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

BIT-DISTRIBUTION-2026-41888 Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2//manifests/ endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS in the sanitizeHtml function. An attacker can execute...

PT-2026-79850

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2//manifests/ endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has...

CVE-2026-71979 INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing

INDI Instrument Neutral Distributed Interface indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers...

PYSEC-2026-3766

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

openssl: AES-OCB IV Ignored on EVP_Cipher() Path

A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface EVPCipher will have their provided Initialization Vector IV silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the...

MINI-QMC6-WH95-RMQ7

Bulletin has no description...

BIT-DISCOURSE-2026-72732 Discourse: Templates endpoint exposes hidden tag names

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discoursetemplates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discoursetemplates/templatesserializer.rb d...

BIT-DISCOURSE-2026-72723 Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymousdefaultnavigationmenutags serializes tags from SiteSetting.defaultnavigationmenutags without applying DiscourseTagging.filtervisible for the anonymous viewer. An...

PT-2026-73250

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous default navigation menu tags serializes tags from SiteSetting.default navigation menu tags without applying DiscourseTagging.filter visible for the anonymous viewer. An...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101281)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101281 advisory. A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a...

PT-2026-73259

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse templates/templates serializer.r...