io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files

A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response...

io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records

A flaw was found in Netty's DnsResolveContext. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing...

Linux kernel Cache Dirent Function Heap Buffer Overflow Privilege Escalation

The vulnerability in the cachefuseadddirenttocache function within the fs/fuse/readdir.c module of the Linux kernel system is related to buffer overflows occurring due to insufficient input validation. Exploitation of this vulnerability may allow an attacker to gain unauthorized access to protect...

ALSA-2026:34911 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fs/smb/client: fix out-of-bounds read in cifssanitizeprepath CVE-2026-43112 kernel: rxrpc: Fix potential UAF after skbunshare failure CVE-2026-45998 kernel: drm/gem: Fix inconsistent plan...

CVE-2026-57623: Improper Validation of Specified Quantity in Input

Unauthenticated Arbitrary Code Execution in W3 Total Cache = 2.9.4 versions...

PT-2026-55373

Summary The JWT signing key cache in TokenKeyResolver uses kid as the sole cache key without namespacing by authority. In applications with multiple JwtBearer schemes pointing to different identity providers, a key fetched for one scheme can satisfy token validation for another. Additionally,...

openSUSE 16 Security Update : python-zeroconf (openSUSE-SU-2026:21175-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21175-1 advisory. Changes in python-zeroconf: - CVE-2026-47180: zeroconf has unbounded recursion in DNS compression-pointer decoder that allows LAN-local denial o...

CVE-2026-55791 Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Craft CMS is a content management system CMS. Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery SSRF and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default...

CVE-2026-55791 Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs

Craft CMS is a content management system CMS. Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery SSRF and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default...

CVE-2026-55791

Craft CMS is a content management system CMS. Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery SSRF and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default...

CVE-2026-55791

Craft CMS vulnerability CVE-2026-55791 enables SSRF and Arbitrary JavaScript Injection via /actions/app/resource-js when assetManager.cacheSourcePaths is false and trustedHosts is permissive. An attacker can poison Host/X-Forwarded-Host to hijack $baseUrl, causing Craft::createGuzzleClient()->...

coderedcms (>=2.0.0, <=2.1.4), puput (1.2.0) +27 more potentially affected by CVE-2026-54262 via wagtail (4.2.4)

wagtail PYPI version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =2.0.0, =0.1.0, =0.3.4, =0.0.1, =1.6.0, =0.18.0, =0.19.2 - wagtail-hallo 0.3.0 - wagtail-images-deduplicator 1.0.0a1 and more Source...

aratinga (>=0.1.0a0.dev0, <=0.1.0a0.dev2), cjkcms-cache (2.3.2) +23 more potentially affected by CVE-2026-54259 via wagtail (6.4.2)

wagtail PYPI version 6.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - aratinga =0.1.0a0.dev0, =4.0.0, =5.2.0, =2.0.2, =0.6.0, =0.0.1, =0.0.1, =0.0.1, =2.4.0, =0.0.1, =0.0.2 - wagtail-donate 1.9.5 and more Source cves...

aratinga (>=0.1.0a0.dev0, <=0.1.0a0.dev2), cjkcms-cache (2.3.2) +23 more potentially affected by CVE-2026-54261 via wagtail (6.4.2)

wagtail PYPI version 6.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - aratinga =0.1.0a0.dev0, =4.0.0, =5.2.0, =2.0.2, =0.6.0, =0.0.1, =0.0.1, =0.0.1, =2.4.0, =0.0.1, =0.0.2 - wagtail-donate 1.9.5 and more Source cves...

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

Impact When Ghost is behind a shared caching layer that results in cached content being shared between different visitors e.g., Fastly, Cloudflare, nginx proxycache, and others, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected...

NPM: Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

NPM: Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header vulnerability discovered by ? in WordPress Npm ghost versions = 4.0.0, = 6.36.0...

GHSA-62Q6-4HV4-VJRW Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

Impact When Ghost is behind a shared caching layer that results in cached content being shared between different visitors e.g., Fastly, Cloudflare, nginx proxycache, and others, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected...

Use of Cache Containing Sensitive Information

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the handling of the x-ghost-preview header when the application is deployed behind a shared caching layer. An attacker can inject malicious content into...

EUVD-2026-39027

Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header...

dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion

A heap buffer overflow was discovered in dnsmasq's DNS cache. When processing DNS responses, dnsmasq expands certain characters into longer escape sequences, but the cache buffer is not sized to hold the expanded result. A specially crafted DNS response can overflow this buffer, potentially...