CVE-2026-12560

The Editorial Rating – Product Review & Rating System plugin for WordPress (versions up to 4.0.5) is vulnerable to Stored Cross-Site Scripting via the Link URL field due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level access can store a pay...

CVE-2026-58302

creationtimestamp| type| source ---|---|--- 2026-06-30 02:29:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphxgqfnwi2t 2026-06-30 04:20:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpi5n3bh7l2o...

SUSE CVE-2026-13676

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode IDN hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize and equal still return...

CVE-2026-12243

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

PT-2026-53940

Name of the Vulnerable Software and Affected Versions Webmention versions prior to 5.8.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of user-supplied Microformat 2 MF2 author properties. An unauthenticated attacker can inject arbitrary...

PT-2026-54442

Name of the Vulnerable Software and Affected Versions @cedar-policy/authorization-for-expressjs versions prior to 0.3.0 Description This middleware integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions. A discrepancy exists because the middleware uses...

CVE-2026-10562: URL Redirection to Untrusted Site

An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improper validation of user-supplied URL input within the web interface. An unauthenticated attacker can craft URLs containing URL-encoded path traversal sequences. When processed by the embedded web...

Apache APISIX URL Redirection

The vulnerability of the Apache APISIX cloud API gateway involves redirecting URLs to an unreliable website. Exploiting this vulnerability could allow a malicious actor to redirect users to any given URL address remotely...

Important: container-tools:rhel8 security, bug fix, and enhancement update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via...

Security update for python-python-multipart (important)

openSUSE security update: security update for python-python-multipart ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21066-1 Rating: important References: bsc1268488 bsc1268496 bsc1268500 bsc1268506 Cross-References: CVE-2026-53537 CVE-2026-53538...

CVE-2026-56224: Session Fixation

Capgo console.capgo.app/login before 12.128.2 accepts accesstoken and refreshtoken in URL query parameters, automatically authenticating users without confirmation. Attackers can craft malicious links to force victims into attacker-controlled sessions, exposing tokens in browser history and logs...

CVE-2026-12560: Improper Neutralization of Input During Web Page Generation

The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-10546: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery SSRF vulnerability in the URL component src/lfx/src/lfx/components/datasource/url.py due to a Time-of-Check/Time-of-Use TOCTOU race condition that can be exploited via DNS rebinding...

PT-2026-53811

Name of the Vulnerable Software and Affected Versions Editorial Rating – Product Review & Rating System versions prior to 4.0.6 Description Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access and above to perform Stored Cross-Site...

CVE-2026-56968

creationtimestamp| type| source ---|---|--- 2026-06-29 23:52:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphonpawcs27 2026-10-13 10:19:23+00:00| seen| MISP/f8adec39-0b02-47ba-9542-6b9dafe336bd...

CVE-2026-54829

creationtimestamp| type| source ---|---|--- 2026-06-29 23:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mphmmd2wiq2i...

CVE-2026-43722

creationtimestamp| type| source ---|---|--- 2026-06-29 22:34:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphkc6ytr427 2026-07-01 02:50:09+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818 2026-07-01 16:00:58+00:00| seen|...

CVE-2026-43720

creationtimestamp| type| source ---|---|--- 2026-06-29 22:33:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphkaonv6522 2026-07-01 02:50:04+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818 2026-07-01 16:01:00+00:00| seen|...

CVE-2026-53429

creationtimestamp| type| source ---|---|--- 2026-06-29 22:19:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphjheouc225...

CVE-2026-43725

creationtimestamp| type| source ---|---|--- 2026-06-29 22:18:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphjez6vuf23 2026-07-01 02:50:14+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818 2026-07-01 16:00:58+00:00| seen|...