CVE-2026-91081: Server-Side Request Forgery (SSRF)

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-91146: Improper Neutralization of Input During Web Page Generation

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, allowing remote actors to inject javascript: links. Attackers can deliver federated content with malicious javascript: hrefs that execute in the instance origin when clicked,...

CVE-2026-85188: Exposure of Sensitive Information to an Unauthorized Actor

Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager Free, Pro 12.1.0, Conditional Content Free, Pro 8.0.0, Content Templater Pro 14.2.0, ReReplacer Pro 16.2.0 for Joomla - The Conditions editor creates a default Condition Set name from the item to which the se...

PT-2026-91559

A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. Processing web content may lead to a denial-of-service...

CVE-2026-43696: Missing Authorization

An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar content without authorization...

Amazon Linux 2 : webkitgtk4 (ALAS-2026-3917)

The version of webkitgtk4 installed on the remote host is prior to 2.52.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3917 advisory. A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6.1, iOS 18.7.1...

Cross-site Scripting (XSS)

Overview @strapi/content-manager is an A powerful UI to easily manage your data. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient sanitization of rendered rich text. An Author-role user can plant malicious tags in a rich text field, and when an Edit...

CVE-2026-90561

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

CVE-2026-90561 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

CVE-2026-90561 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2024-004029)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-004029 advisory. A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. AddType and similar configuration,...

curl: CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints

Hi all, I found a way for a server to defeat --remote-header-name's -J no-clobber guarantee: with curl -O -J -i, sending a 103 Early Hints before the final response or an ETag ahead of Content-Disposition under --etag-save lets a server overwrite an existing file it names via Content-Disposition,...

Exploit for Improper Input Validation in N8N

🛡️ AI Security Tool Module n8n Full C...

PT-2026-90572

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

Linux Distros Unpatched Vulnerability : CVE-2026-22591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to versions 2.6.12, 2.14.6,...

CVE-2026-89773

A flaw was found in the drm/amd/display component of the Linux kernel. This vulnerability occurs because the High-bandwidth Digital Content Protection HDCP configuration routine is skipped during a transition state when an invalid dmstreamctx is present. This can lead to the HDCP routine not bein...

CVE-2026-54166

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

CVE-2026-54135

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Denial of Service DoS via memory exhaustion OOM. In...

CVE-2026-89619

A buffer overflow in the Linux kernel's intel-quickspi HID driver (part of the intel-thc-hid subsystem) occurs because quickspi_get_report() copies the entire device-supplied report into the caller's buffer without validating it against the caller-provided length. A malicious HID touch controller...

CVE-2026-54135

AirSane is a SANE frontend and scanner server supporting Apple's AirScan protocol. Versions prior to 0.4.12 are vulnerable to a remote, unauthenticated Denial of Service (OOM) in its custom HTTP server. The root cause lies in the HttpServer::Request::content function in httpserver.cpp, which read...