CVE-2026-55790 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

Craft CMS is a content management system CMS. In versions 5.0.0-RC1 through 5.9.22 and 4.0.0-RC1 through 4.17.15, an attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types...

CVE-2026-43361

CVE-2026-43361 affects the Linux kernel Btrfs subsystem. The issue arises when snapshotting a previously received subvolume can overflow BTRFS_UUID_KEY_RECEIVED_SUBVOL, causing a transaction abort and putting the filesystem into read-only mode. The vulnerability can be triggered by repeatedly sna...

CVE-2026-31857

CVE-2026-31857 (CraftCMS) : A Remote Code Execution vulnerability exists in Craft CMS before versions 5.9.9 and 4.17.4 in the control panel via the BaseElementSelectConditionRule::getElementIds() path. User-controlled input is passed to renderObjectTemplate() (unsandboxed Twig with escaping disab...

PT-2026-20506

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.0 Description InvoicePlane is a self-hosted open source application used for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS issue exists in the Edit Invoices functionality. The application...