Linux Distros Unpatched Vulnerability : CVE-2026-69152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand does not apply...

CVE-2026-68585: Missing Authorization

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including title for publish-forbidden documents without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a block ID...

PT-2026-76157

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access, even when the intention of the configuration was for each user to have an account. The earliest affected version is...

PT-2026-67402

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description An issue exists in the '/api/block/getBlockInfo' endpoint that allows the disclosure of document root metadata for documents marked as excluded from publishing. This occurs because the system fails to...

PT-2026-85336

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pm3w-vxp9-ccwc. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint tha...

Malicious Package

Overview list-issue-predecessor-dependencies-block is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious code in list-issue-predecessor-dependencies-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbd4d4e3aa51ec1a7ebc0a0d4f728698503432546f139f67998849f8fff9b614 npm package [email protected] auto-executes index.js from three lifecycle hooks preinstall, install, postinstall on np...

MAL-2026-11430 Malicious code in list-issue-predecessor-dependencies-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbd4d4e3aa51ec1a7ebc0a0d4f728698503432546f139f67998849f8fff9b614 npm package [email protected] auto-executes index.js from three lifecycle hooks preinstall, install, postinstall on np...

AlmaLinux 9 : kernel (ALSA-2026:47040)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47040 advisory. kernel: xfrm: Duplicate SPI Handling CVE-2025-39797 kernel: lib/buildid: use kernelread for sleepable context CVE-2026-23002 kernel: futex: Drop...

OS Command Injection

github.com/kube-logging/logging-operator is vulnerable to OS Command Injection. The vulnerability is due to the Fluentd configuration renderer FluentRender writing unescaped CRD strings such as Flow recordtransformer.records values directly into fluent.conf, which allows an attacker with permissi...

Authorization Bypass

goshs is vulnerable to Authorization Bypass. The vulnerability is due to inconsistent path handling, where files are opened using a cleaned path while authorization checks are performed against the raw req.URL.Path. This allows an attacker to append a trailing slash to bypass .goshs ACL-file...

CVE-2026-18062 Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18062 Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18062

CVE-2026-18062 affects Kadence Blocks — Page Builder Toolkit for Gutenberg Editor for WordPress, version ≤ 3.7.8.1. The issue is a Stored Cross-Site Scripting vulnerability in the Identity Block Inner Image Content path caused by insufficient input sanitization and output escaping. Exploitation r...

EUVD-2026-51696

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

CVE-2026-10827

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

CVE-2026-10827 Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

CVE-2026-10827 Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

PT-2026-67129

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-10827: Insufficient Verification of Data Authenticity

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...