PT-2026-97676

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through...

PT-2026-97673

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190

This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through...

ROS-20260923-73-0074

The vulnerability of the adjustinuseandcalccost function in the block/blk-iocost.c module, which is part of the Linux kernel’s block-level support, is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to trigger a service failure...

Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass

A vulnerability in Nuclei's DAST template loading path allows unsigned code: protocol templates to execute, bypassing the cryptographic signature requirement that is meant to prevent arbitrary command execution from untrusted templates. Affected Component The issue is in the template loader's DAS...

CVE-2026-93749

A flaw was found in source-map-js. This vulnerability allows a remote attacker to trigger a denial of service by providing malformed input. Specifically, by supplying extremely large offset line values in indexed source maps, the attacker can cause the service's event loop to block, making it...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

CVE-2026-88788

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that...

EUVD-2026-84275

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that...

CVE-2026-88788 Text Styler <= 1.1.1 - Contributor+ Stored XSS

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that...

CVE-2026-88788 Text Styler <= 1.1.1 - Contributor+ Stored XSS

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that...

CVE-2026-76802: Improper Neutralization of Special Elements used in an OS Command

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator...

CVE-2026-88788: Improper Neutralization of Input During Web Page Generation

The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that...

RHEL 7 : kernel-rt (RHSA-2026:70308)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70308 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

PT-2026-96647

Name of the Vulnerable Software and Affected Versions Contextual Related Posts versions prior to 4.4.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with author-level access and above to perform Stored Cross-Site Scripting. This is achieved by...

RHEL 7 : kernel (RHSA-2026:70290)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70290 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fanotify: fix false positive ...

CVE-2026-64847

AnyIO is a high-level asynchronous concurrency framework. Prior to version 4.14.2 , process-pool workers are started with stderr connected to a pipe that the parent never drains , despite documentation stating all three standard streams are redirected. While stdin and stdout are redirected to /de...

CVE-2026-61795

Capsule , a multi-tenancy and policy-based framework for Kubernetes, is affected in versions 0.13.0 through 0.13.7 . The root cause lies in hostnameRegexHandler.OnUpdate (internal/webhook/tenant/validation/hostname_regex.go), which reverses the new and old Tenant parameters , causing the webhook ...

CVE-2026-40538

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-force attacks...

CVE-2026-40538

Synology DiskStation Manager (DSM) is affected by an improper restriction of excessive authentication attempts in the Auto block feature. Versions prior to 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 allow remote attackers to read limited files via brute-force attacks. The CVSS 3.1 score i...