316 matches found
[SECURITY] Fedora 45 Update: phodav-3.0-15.fc45
ph=E1=BB=9Fdav is a WebDAV server implementation using libsoup3 RFC 4918...
PT-2026-103060
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title attribute of the bt bb service shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
PT-2026-103055
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt bb css image grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi...
PT-2026-103056
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt bb icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it...
PT-2026-103057
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt bb image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes ...
iceoryx2 (>=0.0.4, <=0.3.0), iceoryx2-bb-lock-free (>=0.0.4, <=0.3.0) +6 more potentially affected by CVE-2026-92612 via iceoryx2-bb-container (>=0.0.3, <=0.3.0)
iceoryx2-bb-container CARGO version =0.0.3, =0.0.4, =0.0.4, =0.0.4, =0.0.3, =0.0.3, =0.0.4, =0.0.4, =0.0.4, =0.3.0 Source cves: CVE-2026-92612 Source advisory: OSV:RUSTSEC-2026-0294...
RUSTSEC-2026-0294 Unsoundness in UTF-8 'String' trait
The String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::asstr converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust...
Unsoundness in UTF-8 'String' trait
The String API in iceoryx2-bb-container exposes its contents as mutable bytes through safe APIs, while String::asstr converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust...
Malicious Package
Overview bb-twl-k7x2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
SUSE CVE-2026-68384
In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves xebomove attaches VF CCS read/write batch buffers BBs to a BO after it transitions NULL/SYSTEM - TT, and detaches them after it transitions TT - SYSTEM. Both...
Malicious code in bb-twl-k7x2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8 The package's install and postinstall lifecycle scripts canary.js run unconditionally on npm install and collect installer-side reconnaissance:...
PT-2026-69705
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc2 Description A NULL pointer dereference occurs in the Linux kernel when detaching CCS read/write buffers. This happens because buffers are freed during Buffer Object BO destruction; if BOs are destroyed...
Malicious code in @flipbit2-bb/scope-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21b4b4d5e8e72141828bf6df5afe2300f5b9496d22f8b05491623fd699496603 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WS-2019-0393
Bb-builder is a malicious package targeting Windows systems and uploads information to a remote server...
CVE-2026-23421
In the Linux kernel, the following vulnerability has been resolved: drm/xe/configfs: Free ctxrestoremidbb in release ctxrestoremidbb memory is allocated in wabbstore, but xeconfigdevicerelease only frees ctxrestorepostbb. Free ctxrestoremidbb0.cs as well to avoid leaking the allocation when the...
CVE-2026-23421
In the Linux kernel, the following vulnerability has been resolved: drm/xe/configfs: Free ctxrestoremidbb in release ctxrestoremidbb memory is allocated in wabbstore, but xeconfigdevicerelease only frees ctxrestorepostbb. Free ctxrestoremidbb0.cs as well to avoid leaking the allocation when the...
CVE-2026-35054
XenForo before 2.3.9 is vulnerable to stored cross-site scripting XSS related to BB code rendering. An attacker can inject malicious scripts through BB code that are stored and executed when other users view the content...
CVE-2026-35054
XenForo before 2.3.9 is vulnerable to stored cross-site scripting XSS related to BB code rendering. An attacker can inject malicious scripts through BB code that are stored and executed when other users view the content...
Xenforo cross-site scripting vulnerabilities
Xenforo is a forum software developed by the Xenforo company. Versions of XenForo prior to 2.3.9 had a cross-site scripting vulnerability. This vulnerability stemmed from the BB code rendering, which contained a stored-cross-site scripting flaw, potentially allowing attackers to inject malicious...
CVE-2026-35054: Improper Neutralization of Input During Web Page Generation
XenForo before 2.3.9 is vulnerable to stored cross-site scripting XSS related to BB code rendering. An attacker can inject malicious scripts through BB code that are stored and executed when other users view the content...