Linux Distros Unpatched Vulnerability : CVE-2026-16379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird...

kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

| Field | Value | |---|---| | Ecosystem | Go | | Package | github.com/getkin/kin-openapi | | Affected versions | = 0.143.0 introduced in v0.2.0, PR 90, 2019-05-07; reproduced on HEAD 30e2923 | | Patched versions | 0.144.0 | --- Summary openapi3filter.ValidateRequest contains a...

GHSA-JPCW-4WR7-C3VQ kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema

| Field | Value | |---|---| | Ecosystem | Go | | Package | github.com/getkin/kin-openapi | | Affected versions | = 0.143.0 introduced in v0.2.0, PR 90, 2019-05-07; reproduced on HEAD 30e2923 | | Patched versions | 0.144.0 | --- Summary openapi3filter.ValidateRequest contains a...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the defaultContentParameterDecoder function. An attacker can cause the application to crash or abort request processing by sending a crafted HTTP request that targets an OpenAPI operation with a content...

CVE-2026-57531

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

EUVD-2026-48736

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

CVE-2026-57531 Milkdown < 7.21.3 DOM XSS via innerHTML Assignment

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

CVE-2026-57531

Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated attackers to execute arbitrary JavaScript in the host application's origin by causing a victim to paste attacker-controlled content. The parseDOM.getAttrs...

GO-2026-5585 Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber

Fiber vulnerable to XSS in AutoFormat Content Negotiation in github.com/gofiber/fiber...

GHSA-RG4H-FPCP-2QM8 Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Summary Microsoft Kiota resolved OpenAPI $refs by fetching remote https URLs and reading local files including absolute / out-of-tree paths, inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary...

CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

OESA-2026-3152 wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. Security Fixes: GNU Wget does n...

OESA-2026-3116 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

OESA-2026-3115 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

OESA-2026-3114 pipewire security update

is a server and user space API to deal with multimedia pipelines,contains command line utilities. Security Fixes: RAOP module accepts unbounded Content-Length values and does not check the pwarrayadd return.CVE-2026-14324...

CVE-2026-14172

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...

CVE-2026-14172

CVE-2026-14172 affects Rapid7 InsightVM, Nexpose, and the Insight Agent. The issue allows a local, low-privilege user to execute discovered executables during authenticated assessments due to lack of file ownership validation, enabling code execution as the scan credential (Scan Engine) or as roo...

SUSE CVE-2026-16317

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

EUVD-2026-48463

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

EUVD-2026-48438

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...