PYSEC-2026-3586 OnionShare Receive mode writes uploaded files even when file uploads are disabled

Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still sen...

SUSE-SU-2026:23052-1 Security update for helm

This update for helm fixes the following issues Update to version 3.21.3. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266598. - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth:...

CVE-2026-16623

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

PT-2026-71431

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.4 Description An issue exists where the software fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint. This allows unauthenticated attackers to abuse private chatflow text-to-speech...

Important: perl-DBI

Issue Overview: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the ismatched method, = was evaluated using Perl...

PT-2026-75951

Summary The /api/v1/text-to-speech/generate endpoint is whitelisted requires no authentication and accepts any chatflowId without checking whether the referenced chatflow is public. An unauthenticated attacker who knows a valid chatflow UUID can abuse that chatflow's TTS credential OpenAI or...

PT-2026-74855

TuxCare rebuilt langchain-text-splitters to address 1 CVE. Fixed in 0.3.11.post1+tuxcare...

Important: perl-DBI

Issue Overview: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the ismatched method, = was evaluated using Perl...

SUSE-SU-2026:23051-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inpu...

Updated perl-Unicode-LineBreak package fixes a security vulnerability

The updated package fixes a security vulnerability: Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. CVE-2026-8594...

CVE-2026-18604 textPlus Text Message and Call App com.gogii.textplus DialerActivity improper export of android application components

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The...

CVE-2026-69083

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP...

CVE-2026-18604: Improper Export of Android Application Components

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function DialerActivity of the component com.gogii.textplus. Such manipulation leads to improper export of android application components. The attack needs to be performed locally. The...

openSUSE 16: warewulf4 / warewulf4-dracut / warewulf4-man / warewulf4-overlay / etc (openSUSE-SU-2026:21509-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21509-1 advisory. Changes in warewulf4: - updated golang.org/x/text to v0.40.0 to fix CVE-2026-56852 bsc1272014 Tenable has extracted the preceding description block...

Malicious code in wacve-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b2e59800b6fa0d3429fb7bccd34b4ae292dc2668919fba704a7b16ddff71071 On import wacveutils, the package's init.py unconditionally invokes checkforupdates, which HTTP-fetches a hardcoded GitHub Gist under the user...

CVE-2026-15206

The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...

CVE-2025-15675

The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end...

CVE-2025-15675 Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text

The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end...

CVE-2025-15675

The Charitable WordPress plugin versions prior to 1.8.5.3 are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape one of the campaign image text fields before it is outputted into an HTML attribute. An attacker with a high-privilege camp...

CVE-2025-15675 Charitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT Text

The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end...