CVE-2026-64607 Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported Content-Encoding header value in the response message. Please note this defect does not affect HttpClient based on the async i/o...

CVE-2026-62391 Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

WordPress simply-poll plugin <= 1.4.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by TAD Group in WordPress Plugin Simply Poll versions = 1.4.1...

WordPress WP Fast Total Search – The Power of Indexed Search plugin <= 1.80.280 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Nabil Irawan in WordPress Plugin WP Fast Total Search versions = 1.80.280...

WordPress TrueBooker – Appointment Booking and Scheduler System plugin <= 1.2.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Karan J in WordPress Plugin TrueBooker versions = 1.2.2...

WordPress Web Directory Free plugin <= 1.7.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Nhien Pham nhienit, thevietronin in WordPress Plugin Web Directory Free versions = 1.7.13...

CVE-2026-56670 ComfyUI: Stored XSS via SVG file upload on the /view endpoint

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline because image/svg+xml and related XML content types were absent from the dangerous-content-type handling, allowing stored cross-site scripti...

CVE-2026-43830 tbc

Full details and mitigation steps are currently restricted and will be published at a later date...

[SECURITY] Fedora 43 Update: valkey-8.1.9-1.fc43

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

[SECURITY] Fedora 44 Update: valkey-9.0.5-1.fc44

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

SUSE CVE-2026-17803

Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. Chromium security severity: Medium...

PT-2026-66744

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. User...

CVE-2026-62999: Improper Limitation of a Pathname to a Restricted Directory

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

PT-2026-66739

The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the mailerpress/v1/contact endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to...

PT-2026-66847

Name of the Vulnerable Software and Affected Versions Contao versions 5.7.0 through 5.7.6 Description An authenticated backend user with access to a specific job can perform a cross-job authorization bypass. By requesting an attachment identifier containing ../ segments, the user can force the jo...

CVE-2026-17566: Improper Neutralization of Special Elements used in an OS Command

pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...

CVE-2026-17803

An insufficient validation of untrusted input flaw was found in the Save to Drive component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=515438919...

EUVD-2026-51310

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message is interpolated into the default HTML exception response without escaping, allowing a crafted missing-route URL to execute...

CVE-2026-66756

CVE-2026-66756 affects Apache Tika, specifically the 4.0.0-alpha-1 series up to, but not including, 4.0.0-beta-1. The issue is described as an Improper Protection of Alternate Path vulnerability. Affected versions are listed as 4.0.0-alpha-1 through before 4.0.0-beta-1; the recommended remediatio...

CVE-2026-66756

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...