EUVD-2026-53175

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

CVE-2026-18817

CVE-2026-18817 affects Baserow up to 2.3.2. The issue involves the function BaserowImpersonateAuthTokenSerializer in backend/src/baserow/api/admin/users/serializers.py (Inactive Non-Staff User Handler). A manipulation may lead to improper authorization and, per the report, remote exploitation is ...

CVE-2026-47682

CVAT contains a path-containment validation flaw in versions 1.6.0–2.64.0. An attacker with write access to a cloud storage added to a CVAT instance, or the ability to add new cloud storages, can overwrite arbitrary files on the server filesystem. The issue enables arbitrary path writes at multip...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when nghttp2sessionmemsend is called re-entrantly during the execution of nghttp2sessionmemrecv. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant...

CLSA-2026-1784943288 TuxCare security update for form-data (1 CVE)

TuxCare rebuilt form-data to address 1 CVE. Fixed in 2.1.4-tuxcare.2...

CLSA-2026-1784856439 TuxCare security update for DOMPurify (2 CVEs)

TuxCare rebuilt DOMPurify to address 2 CVEs. Fixed in 2.4.7-tuxcare.4...

CLSA-2026-1784596278 TuxCare security update for DOMPurify (1 CVE)

TuxCare rebuilt DOMPurify to address 1 CVE. Fixed in 2.4.3-tuxcare.3...

CLSA-2026-1784596295 TuxCare security update for tough-cookie (2 CVEs)

TuxCare rebuilt tough-cookie to address 2 CVEs. Fixed in 2.2.2-tuxcare.2...

CLSA-2026-1782954034 TuxCare security update for set-value (13 CVEs)

TuxCare rebuilt set-value to address 13 CVEs. Fixed in 2.0.0-tuxcare.1...

CLSA-2026-1782089812 TuxCare security update for js-cookie (12 CVEs)

TuxCare rebuilt js-cookie to address 12 CVEs. Fixed in 2.2.1-tuxcare.1...

CLSA-2026-1780534264 TuxCare security update for jspdf (12 CVEs)

TuxCare rebuilt jspdf to address 12 CVEs. Fixed in 2.5.1-tuxcare.1...

CLSA-2026-1778028242 TuxCare security update for com.squareup.retrofit2 (1 CVE)

TuxCare rebuilt 2 com.squareup.retrofit2 packages to address 1 CVE. Fixed in 2.9.0-tuxcare.1...

CLSA-2026-1776991064 TuxCare security update for ms (5 CVEs)

TuxCare rebuilt ms to address 5 CVEs. Fixed in 2.1.3-tuxcare.1...

CLSA-2026-1776991063 TuxCare security update for ms (13 CVEs)

TuxCare rebuilt ms to address 13 CVEs. Fixed in 2.0.0-tuxcare.1...

CLSA-2026-1774657399 TuxCare security update for ip (13 CVEs)

TuxCare rebuilt ip to address 13 CVEs. Fixed in 2.0.0-tuxcare.1...

CLSA-2026-1773101693 TuxCare security update for debug (7 CVEs)

TuxCare rebuilt debug to address 7 CVEs. Fixed in 2.1.1-tuxcare.2...

CLSA-2026-1773015268 TuxCare security update for trim-newlines (13 CVEs)

TuxCare rebuilt trim-newlines to address 13 CVEs. Fixed in 2.0.0-tuxcare.1...

CLSA-2026-1773101696 TuxCare security update for tough-cookie (6 CVEs)

TuxCare rebuilt tough-cookie to address 6 CVEs. Fixed in 2.2.0-tuxcare.1...

netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling

A flaw was found in Netty, a network application framework. A remote attacker can exploit a vulnerability in the HTTP/2 Hypertext Transfer Protocol version 2 maximum header size handling. By sending a specific SETTINGSMAXHEADERLISTSIZE setting, an attacker can cause Netty to produce an exception...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/2 header block handling. An attacker can cause excessive memory consumption by sending specially crafted HTTP/2 requests that bypass memory limits. Remediation A fix was...