npm: ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization

npm: ApostropheCMS: Same-parent page reorder in @apostrophecms/page move re-ranks a restricted parent's children without create authorization vulnerability discovered by ? in WordPress npm apostrophe versions 4.33.0...

Rocky Linux 8 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc (crlsa-2022_7461)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227461 advisory. libreoffice: Incorrect trust validation of signature with ambiguous KeyInfo children CVE-2021-25636 Tenable has extracted the preceding description block directly...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - dm btree remove: fixed the use of a function after the free operation in rebalancechildren. - Moved the dmtmunlock function to after dmtmdec...

Meta Failed to Catch Hundreds of AI Child Abuse Ads. Some Included Images of Real Kids

Images of real children—including a member of a European royal family—were used to create some of the 350 ads containing child sexual abuse. Lawmakers say they plan to investigate...

UBUNTU-CVE-2026-74605

In the Linux kernel, the following vulnerability has been resolved: eventfs: Use children field for rcu head and add memory barriers When an eventfs inode is freed, it sets ei-isfreed and then uses its ei-list to add it to the srcu link list as the list field is a union with the rcu list head. As...

Meta ordered to pay $942 million over harm to children

A New Mexico court has ordered Meta to pay a total of $942 million after finding that Facebook and Instagram harmed young users and that the company misled consumers about the safety of its platforms. Reportedly, the decision combines a $375 million civil-penalty verdict from March with a newly...

EUVD-2026-52272

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

ICE Collected Nearly 1 Million People’s DNA Last Year—Including Young Children

Internal documents show ICE's DNA collection has skyrocketed in the second Trump administration. Now hundreds of thousands of people never convicted of a crime are in an FBI criminal database forever...

CVE-2026-18203 Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs ...

CVE-2026-49210: Improper Neutralization of Input During Web Page Generation

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml interpolates the client-controlled childrenid.tag value from LiveComponentSubscriber and InterceptChildComponentRenderSubscriber directly in...

CVE-2026-27402

Unauthenticated Cross Site Scripting XSS in Kids Life | Children School WordPress = 5.2 versions...

CVE-2026-27402

CVE-2026-27402 refers to an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress theme set for Kids Life | Children School, affected in versions

CVE-2026-27402 WordPress Kids Life | Children School WordPress theme <= 5.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Kids Life | Children School WordPress = 5.2 versions...

CVE-2026-27402

Unauthenticated Cross Site Scripting XSS in Kids Life | Children School WordPress = 5.2 versions...

CVE-2025-69156

CVE-2025-69156 details unauthenticated Cross Site Scripting in the WordPress Kids Zone – Children WordPress Theme, affected Versions

CVE-2026-27402: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Kids Life | Children School WordPress = 5.2 versions...

CVE-2025-69156: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Kids Zone - Children WordPress Theme = 5.4 versions...

PT-2026-54972

Unauthenticated Cross Site Scripting XSS in Kids Life | Children School WordPress = 5.2 versions...

CVE-2026-8141

CVE-2026-8141 affects the WordPress plugin “Ajax Load More - Filters” (v

CVE-2026-8141 Ajax Load More - Filters <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy_include_children' Field

The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomyincludechildren' parameter in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...