CVE-2026-12484

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

Security update for google-cloud-sap-agent (important)

openSUSE security update: security update for google-cloud-sap-agent ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21010-1 Rating: important References: bsc1265764 bsc1265991 bsc1266604 Cross-References: CVE-2026-33186 CVE-2026-33814 CVE-2026-3498...

UBUNTU-CVE-2026-45409

Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the validcontexto function pri...

PT-2026-41956

Name of the Vulnerable Software and Affected Versions idna versions prior to 3.14 Description A specially crafted argument passed to the idna.encode function can consume significant system resources, potentially leading to a denial-of-service. This occurs because payloads containing specific...

CVE-2026-42090

Notesnook exposes a stored XSS in the note export flow that can escalate to remote code execution in the desktop app. Root cause: exported fields (title, headline, content) are inserted into the HTML template without escaping, which is then rendered into a same-origin, unsandboxed iframe via ifra...

WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Profile Builder Pro versions = 3.15.0...

CVE-2026-41459

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed rootpath value...

CVE-2026-41459 Xerte Online Toolkits Path Disclosure via /setup

Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed rootpath value...

CVE-2026-31908

Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...

CVE-2025-68857

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL Injection.This issue affects Paid Downloads: from n/a through = 3.15...

CVE-2025-68857 WordPress Paid Downloads plugin <= 3.15 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL Injection.This issue affects Paid Downloads: from n/a through = 3.15...

EUVD-2025-202068

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in flexmls Flexmls® IDX flexmls-idx allows Phishing.This issue affects Flexmls® IDX: from n/a through = 3.15.7...

BBMRI-ERIC Negotiator 安全漏洞

BBMRI-ERIC Negotiator is a biospecimen repository access tool from the Austrian company BBMRI-ERIC. A security vulnerability exists in BBMRI-ERIC Negotiator version v3.15.2, which stems from improper manipulation of the userID parameter and could lead to an insecure direct object reference attack...

UBUNTU-CVE-2025-47792

Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service...

BlogCMS 安全漏洞

BlogCMS is a PHP and MySQL based blogging system by Pramod Mahato Individual Developer in India. A security vulnerability exists in BlogCMS version 3.1.15, which stems from improper handling of the /bid/1/admin/entry-edit/ path, which could allow remote attackers to obtain sensitive information...

Open eClass Platform 安全漏洞

Open eClass Platform is an integrated course management system for Open eClass. A security vulnerability exists in Open eClass Platform version 3.15 and earlier, which stems from an arbitrary file upload vulnerability in the save function of the H5P module that could lead to unrestricted remote...

Medium: iperf3

Issue Overview: It is possible for a malicious or malfunctioning client to send less than the expected amount of data to the server. If this happens, the server will hang indefinitely waiting for the remainder or until the connection gets closed. Because iperf3 is deliberately designed to service...

WordPress Plugin Media Library Assistant 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

GitLab gitlab-vscode-extension 代码问题漏洞

Gitlab gitlab-vscode-extension is a VSCode code editor extension for Gitlab from Gitlab USA. A code issue vulnerability exists in versions prior to gitlab-vscode-extension v3.15.0 that allows an attacker to execute code on a user's system...