PT-2026-58105

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 12.3.0 Description The public rank-filter API in the Pillow Python imaging library allows a native heap out-of-bounds write when a very large odd filter size is provided. This occurs because the...

CVE-2026-12385

CVE-2026-12385 affects the Smart Slider 3 WordPress plugin up to version 3.5.1.37. The issue is a Sensitive Information Exposure via the keyword parameter, enabling authenticated attackers with contributor-level access and above to extract titles and full content excerpts from private, draft, pen...

CVE-2026-12385 Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter

The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content...

Security update for curl

This update for curl fixes the following issues CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. CVE-2026-8458: wrong reuse for different services bsc1268407. CVE-2026-8924: traling dot domain super cookie bsc1268409. CVE-2026-8927: env-set cross-proxy Digest auth state leak bsc1268413...

SUSE-SU-2026:2925-1 Security update for curl

This update for curl fixes the following issues - CVE-2026-4873: connection reuse ignores TLS requirement bsc1262631. - CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. - CVE-2026-8458: wrong reuse for different services bsc1268407. - CVE-2026-8924: traling dot domain super cookie...

Security update for the Linux Kernel (Live Patch 43 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.173 fixes various security issues The following security issues were fixed: CVE-2025-71089: iommu: disable SVA when CONFIGX86 is set bsc1256615. CVE-2026-23393: bridge: cfm: Fix race condition in peermep deletion bsc1260524...

PYSEC-2026-2779 Open Babel has out-of-bounds write in PQS coord_file parser

Summary A memory-safety vulnerability in Open Babel's PQS parser allowed an out-of-bounds write when reading a crafted input file. Details The flaw was in the coordfile parsing path of the PQS reader. A malformed coord file specifier caused the parser to write past the end of its destination...

Open Babel has out-of-bounds write in MSI translationVectors[]

SummaryA memory-safety vulnerability in Open Babel's MSI parser allowed anout-of-bounds write into the translationVectors array whenreading a crafted input file. DetailsThe MSI reader stored cell translation vectors into a fixed-sizetranslationVectors array. A malformed input could push morevecto...

Open Babel has out-of-bounds write in ORCA nAtoms parser

SummaryA memory-safety vulnerability in Open Babel's ORCA parser allowed anout-of-bounds write when reading a crafted input file. DetailsThe flaw was in the nAtoms handling of the ORCA reader. A malformedinput caused the parser to write past the end of its destinationbuffer. ImpactOpen Babel is a...

PYSEC-2026-2544 kas checks out SHA-like git branches as valid commits

Impact When relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the...

PYSEC-2026-2448 Django vulnerable to Uncontrolled Resource Consumption

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29. URLField.topython in Django calls urllib.parse.urlsplit, which performs NFKC normalization on Windows that is disproportionately slow for certain Unicode characters, allowing a remote attacker to cause denial o...

WordPress WP Customer Area plugin <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin WP Customer Area versions = 8.3.5...

CVE-2026-57738

creationtimestamp| type| source ---|---|--- 2026-07-13 11:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjldylgvv2h 2026-07-13 11:24:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjler6l6c2w 2026-07-13 11:28:13+00:00| seen|...

CVE-2026-57719

creationtimestamp| type| source ---|---|--- 2026-07-13 11:20:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjl4ur7zb2b 2026-07-13 11:23:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjlchorxn24 2026-07-13 11:29:15+00:00| seen|...

CVE-2026-57726

creationtimestamp| type| source ---|---|--- 2026-07-13 11:18:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjkzjborp27 2026-07-13 11:18:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjl23jjqs2w 2026-07-13 11:22:05+00:00| seen|...

CVE-2026-57739

creationtimestamp| type| source ---|---|--- 2026-07-13 11:01:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjk47dll32g 2026-07-13 11:24:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjle25nl22b 2026-07-13 11:25:20+00:00| seen|...

CVE-2026-57744

creationtimestamp| type| source ---|---|--- 2026-07-13 10:43:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjj3ams7d2e 2026-07-13 11:26:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjlhle6wj22 2026-07-13 11:28:18+00:00| seen|...

CVE-2026-61971

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through = 2.6.3...

CVE-2026-57771

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through = 3.7...

CVE-2026-57734

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through = 5.4.3...