CVE-2026-59284: Improperly Controlled Modification of Dynamically-Determined Object Attributes

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spring Cloud Commons 4.3.0 - 4.3.3 Spring Cloud Commons 4.0.0 - 4.2.6 Spring Cloud Commons 3.1.10 and earlier...

CVE-2026-47850: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Spring Data REST does not preserve the persisted version @Version property of an aggregate root when handling an HTTP PUT against an immutable target type. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20...

PT-2026-81954

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

ALSA-2026:60226 Moderate: attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fixes: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 For more details about...

BIT-KEYCLOAK-2026-3911 Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint

A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized...

BIT-KEYCLOAK-2026-0871 Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the syste...

EUVD-2026-65304

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...

CVE-2025-9878 Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied...

SUSE CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

ALSA-2026:59380 Moderate: attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fixes: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 For more details about...

CVE-2026-77144: Improperly Controlled Modification of Dynamically-Determined Object Attributes

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

RHEL 10 : attr (RHSA-2026:59380)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59380 advisory. The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists,...

kernel: net: openvswitch: reject oversized nested action attrs

A flaw was found in Open vSwitch in the Linux kernel. Improper handling of oversized nested action attributes can lead to a truncated length field, which could be exploited by a local attacker to alter kernel memory. This alteration might result in the disclosure of sensitive information or a loc...

CVE-2026-49452

A flaw was found in WeasyPrint, a tool designed to create PDF documents from web content. When processing untrusted HTML with presentational hints enabled, WeasyPrint embeds unescaped HTML attribute values directly into CSS declarations. This vulnerability allows a remote attacker to inject...

Improper Authentication

Keycloak is vulnerable to Improper Authentication. The vulnerability is due to incorrect handling of SAML identity provider metadata that lacks key usage attributes, which allows an unauthenticated attacker to bypass SAML signature validation, forge a SAML response, and gain unauthorized access t...

CVE-2026-10618

Hugo versions 0.93.0 through 0.165.0 are affected by a stored cross-site scripting vulnerability in the default fenced-code-block renderer. The root cause is in markup/internal/attributes/attributes.go: the New function converts attribute values from byte slices to strings before storage, bypassi...

CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-10618 Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-10618 Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...