Kiteworks multiple vulnerabilities

RECOMMENDED PRACTICES Fixed in version 9.5.0 and 9.5.1. 2. DESCRIPTION Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the...

CVE-2026-27085

Shop manager Content Injection in Astra WordPress Theme = 4.13.12 versions...

CVE-2026-27085 WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability

Shop manager Content Injection in Astra WordPress Theme = 4.13.12 versions...

CVE-2026-27085 WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability

Shop manager Content Injection in Astra WordPress Theme = 4.13.12 versions...

EUVD-2026-89815

Shop manager Content Injection in Astra WordPress Theme = 4.13.12 versions...

CVE-2026-27085

The Astra WordPress Theme versions

WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability

Content Injection vulnerability discovered by savphill in WordPress Theme Astra WordPress Theme versions = 4.13.12...

AlmaLinux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1782908606)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782908606 advisory. - When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to...

PT-2026-103528

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.1 Description Content Injection occurs due to insufficient validation of a URL parameter in the PDF viewer. This flaw allows an attacker-controlled document to be loaded and displayed under the trust of the...

PT-2026-103147

Shop manager Content Injection in Astra WordPress Theme = 4.13.12 versions...

CVE-2026-27085: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Shop manager Content Injection in Astra WordPress Theme = 4.13.12 versions...

CVE-2026-102090: URL Redirection to Untrusted Site

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of...

CLEANSTART-2026-WE63080 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CLEANSTART-2026-RI09437 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

CVE-2026-56858 affects multiple packages. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. See references for individual vulnerability details...

CVE-2026-59815

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...

CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

CVE-2026-86802

To Do List Member is a WordPress plugin that allows unauthenticated users to create arbitrary published posts and taxonomy terms due to missing authorization and nonce checks in its import routine. The plugin also fails to validate the source location it fetches imported data from, enabling unaut...

WordPress To Do List Member plugin 1.4-1.6 - Unauthenticated Content Injection vulnerability

Unauthenticated Content Injection vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin To Do List Member versions 1.4-1.6...

Important: Red Hat Security Advisory: abrt security update

An update for abrt is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...