osbuild-composer security, bug fix, and enhancement update

175-1.0.1 - Track github upstream...

CVE-2026-15383

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383

The Blog Floating Button WordPress plugin, version 1.4.20 and below , is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin fails to sanitize or escape the visitor User-Agent header, which is accepted through an unauthenticated tracking REST endpoint. This malicious inp...

CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

EUVD-2026-52174

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-12965 Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking

The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database...

CVE-2026-12965

The Super Store Finder WordPress plugin (versions before 7.11 ) is vulnerable to unauthenticated SQL injection due to improper sanitization of a parameter within an unauthenticated AJAX action . An attacker can exploit this flaw to perform SQL injection and extract data from the database. The vul...

CVE-2026-12965 Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking

The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database...

LifeOS 7.28.3

LifeOS is a Life Operating System. It knows your goals, the people who matter to you, and where you are right now, and it works to move you toward where you want to be. The engine underneath is a verifiable loop: turn any request into testable criteria, then climb until they pass. This is the fir...

CVE-2026-15383: Improper Neutralization of Input During Web Page Generation

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

onyx-agent

Onyx Agent v68 Multi-LLM agent framework for security testing...

CVE-2026-18059

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

EUVD-2026-36589

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag...

Top 7 Enterprise IT Asset Management Software for 2027

Compare 7 enterprise IT asset management platforms for 2027, covering security, automation, cost, compliance, lifecycle tracking and business requirements...

SUSE CVE-2026-35600

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdue email notifications without escaping Markdown special characters. When rendered by goldmark and sanitized by bluemonday which allows and tags,...

kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nfconntrackhelper. When a connection tracking helper is unregistered, its associated expectations are not properly cleaned up. This oversight can lead to a use-after-free vulnerability, where the system attempts t...

CNVD-2022-60632

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:00+00:00| seen| https://t.me/CVEhub/2472 2026-07-29 12:01:01+00:00| seen| https://t.me/CVEhub/2204 2026-07-30 00:01:39+00:00| seen| https://t.me/CVEhub/2472 2026-07-30 00:01:40+00:00| seen| https://t.me/CVEhub/2204 2026-08-01...

CVE-2026-12935: Stack-based Buffer Overflow

The TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger...

CVE-2026-64713

This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link...