CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

CLSA-2026-1785468075 TuxCare security update for protobufjs (11 CVEs)

TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1...

CLSA-2026-1785204338 TuxCare security update for undici (6 CVEs)

TuxCare rebuilt undici to address 6 CVEs. Fixed in 6.11.1-tuxcare.4...

CLSA-2026-1784164061 TuxCare security update for 2 packages (5 CVEs)

TuxCare rebuilt 2 packages to address 5 CVEs. Fixed in 6.10.2-tuxcare.1...

CLSA-2026-1783386132 TuxCare security update for guzzlehttp/guzzle (2 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 2 CVEs. Fixed in 6.0.2-p1+tuxcare...

CLSA-2026-1781052732 TuxCare security update for ajv (4 CVEs)

TuxCare rebuilt ajv to address 4 CVEs. Fixed in 6.11.0-tuxcare.1...

CLSA-2026-1780620679 TuxCare security update for @angular (4 CVEs)

TuxCare rebuilt 19 @angular packages to address 4 CVEs. Fixed in 6.0.1-tuxcare.1...

CLSA-2026-1780620667 TuxCare security update for cross-spawn (1 CVE)

TuxCare rebuilt cross-spawn to address 1 CVE. Fixed in 6.0.5-tuxcare.1...

CLSA-2026-1779065200 TuxCare security update for guzzlehttp/guzzle (5 CVEs)

TuxCare rebuilt guzzlehttp/guzzle to address 5 CVEs. Fixed in 6.3.3-p1+tuxcare...

CLSA-2026-1774570936 TuxCare security update for ajv (4 CVEs)

TuxCare rebuilt ajv to address 4 CVEs. Fixed in 6.14.0-tuxcare.1...

CLSA-2025-1766016492 TuxCare security update for org.springframework (11 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 11 CVEs. Fixed in 6.0.16-tuxcare.1...

EUVD-2026-52571

A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched...

Amazon Linux 2023 : python3-tornado (ALAS2023-2026-2016)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2016 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving...

CVE-2026-3245

Technical details for CVE-2026-3245 are not publicly available in the provided documents. Monitor for updates; no product/version-specific information, exploitable vectors, or fixes are described here.

CVE-2026-3245

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution...

MGASA-2026-0312 Updated kernel, kmod, bluez, firmware, wireless-regdb and drakx-installer-images packages fix security vulnerabilities

Upstream kernel version 6.18.39 fixes bugs and vulnerabilities. The kmod, bluez, wireless-regdb, firmware and drakx-installer-images packages have been updated to work with this new kernel...

CVE-2026-17571

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-15601 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

CVE-2026-17567

The CVE-2026-17567 entry affects the WordPress plugin Fluent Forms

CVE-2026-12721

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...