PT-2026-63794

Summary Loofah::HTML5::Scrub.allowed uri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references tab or line feed. This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references , , bu...

CVE-2026-52476

CVE-2026-52476 affects aiflowy up to version 2.1.2. The vulnerability is a SQL Injection in getPageData (DatacenterQuery.java), enabling a remote attacker to obtain sensitive information. Documents consistently identify the flaw, but do not provide remediation details or exploit code. No explicit...

CVE-2026-52476

SQL Injection vulnerability in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file...

📄 WordPress Salon Booking System 9.5 Unauthenticated Shell Upload

WordPress Salon Booking System plugin version 9.5 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable request flow...

PT-2026-61960

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async get media image method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...

PT-2026-62043

Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ss validate header bounds only the root index against the node pool node capacity. The order-statistics and min/max queries...

PT-2026-63793

Summary Loofah::HTML5::Scrub.allowed uri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while allowed uri...

EulerOS Virtualization 2.10.1 : systemd (EulerOS-SA-2026-2840)

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient...

EulerOS Virtualization 2.10.0 : systemd (EulerOS-SA-2026-2871)

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient...

Amazon Linux 2 : perl-DBI, --advisory ALAS2-2026-3825 (ALAS-2026-3825)

The version of perl-DBI installed on the remote host is prior to 1.627-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3825 advisory. DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is...

GHSA-X27W-589X-FRM2 Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal isr function reads the xastropath query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the...

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal isr function reads the xastropath query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the...

Cross-site Scripting (XSS)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the renderHTMLElement function. An attacker can inject arbitrary event-handler attributes or sibling...

CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in...

CVE-2026-55833

Netty (network application framework) contains a vulnerability in SPDY header decoding. Prior to versions 4.1.136.Final and 4.2.16.Final, the zlib-compressed header blocks may continue inflating after the header parser exceeds maxHeaderSize, allowing a remote peer to send a small compressed HEADE...

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Summary Pillow's public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits. In 4-byte pixel modes such as RGBA, this becomes a controlled backward heap underwrite: for a source image of width W, Pillow writes 4 W...