Astra Linux – Vulnerability in Thunderbird

Thunderbird allows the use of the Text DirectionOverride Unicode Character in filenames. As a result, an email attachment might be incorrectly displayed as a document file, when in fact it is an executable file. Older versions of Thunderbird will remove this character and display the correct file...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in several Ansible modules, where parameters containing credentials, such as “secrets,” were logged in plain text on managed nodes, and were also made visible on the controller node when run in verbose mode. These parameters were not protected by the “nolog” feature. An...

Astra Linux – Vulnerability in Qemu

A flaw was discovered in the QEMU-built-in VNC server during the processing of ClientCutText messages. A incorrect exit condition may lead to an infinite loop when inflating a zlib buffer controlled by an attacker in the inflatebuffer function. This could allow a remotely authenticated client, wh...

Astra Linux - Vulnerability in Thunderbird

When processing a PGP/MIME payload containing digitally signed text, the first paragraph of the text was never displayed to the user. This is because the text was interpreted as a MIME message, and the first paragraph was always treated as part of the email header. A digitally signed text from a...

Astra Linux – Vulnerability in pillow

A issue was discovered in Pillow prior to version 10.0.0. It is a denial-of-service attack where memory is uncontrollably allocated to processing a given task, potentially causing a service to crash due to running out of memory. This occurs for truetype in ImageFont when textlength in an ImageDra...

Medium: jsoup

Issue Overview: jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permi...

CVE-2026-90941: Missing Authorization

novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP o...

CVE-2026-90713: Improper Resource Shutdown or Release

A security flaw has been discovered in vllm-project vLLM up to 0.29.0. The affected element is the function TiktokenTokenizer::new of the file rust/src/text/src/backend/hf/mod.rs of the component tiktoken vocab File Handler. The manipulation results in denial of service. The attack is only possib...

CVE-2025-63842: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...

MiracleLinux 9 : qt5-qtbase-5.15.9-11.el9_8.1 (AXSA:2026-1827:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1827:02 advisory. qt: Qt: Denial of Service via out-of-bounds read in text codec handling CVE-2026-9499 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : qt5-qtbase-5.15.3-9.el8_10 (AXSA:2026-1824:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1824:01 advisory. qt: Qt: Denial of Service via out-of-bounds read in text codec handling CVE-2026-9499 Tenable has extracted the preceding description block directly from the...

Cross-site Scripting (XSS)

Overview @strapi/content-manager is an A powerful UI to easily manage your data. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient sanitization of rendered rich text. An Author-role user can plant malicious tags in a rich text field, and when an Edit...

CVE-2026-90561 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

CVE-2026-90561

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 are affected by a stored XSS in the content manager WYSIWYG preview component (PreviewWysiwyg.tsx). The component fails to strip [removed] tags from rich text, allowing an Author -role user to inject malicious scripts that execute when an E...

PT-2026-90832

Name of the Vulnerable Software and Affected Versions Strapi versions 4.x through 4.26.2 Strapi versions prior to 5.48.1 Description A stored cross-site scripting issue exists in the content manager WYSIWYG preview component due to a failure to strip script tags from rich text. A user with the...

CVE-2025-63842

A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...

PT-2026-90989

A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...

CVE-2026-90535

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

CVE-2026-90535 Flowise before 3.1.4 Denial of Service via text-to-speech/abort

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting...

CVE-2026-90535

Flowise versions before 3.1.4 are affected by an unauthenticated denial-of-service vulnerability in the /api/v1/text-to-speech/abort endpoint. The root cause is that the endpoint accepts user-supplied chatflowId and chatId values without ownership verification, allowing an attacker to terminate a...