Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-65755

Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially...

CVE-2026-64874

Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs...

EUVD-2026-47902

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-65755

Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially...

CVE-2026-65755

Summary: CVE-2026-65755 concerns the Joomla extension family from regularlabs.com (Articles Anywhere and Users Anywhere). The issue is a date-sensitive query-cache leakage caused by cache keys that do not retain a bounded time component, allowing cached results to remain active across future publ...

EUVD-2026-47912

Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

EUVD-2026-47914

Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs...

CVE-2026-64874

Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs...

CVE-2026-64799

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...

EUVD-2026-47915

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

EUVD-2026-47886

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

PT-2026-63609

CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

PT-2026-64200

Name of the Vulnerable Software and Affected Versions Heimdall Data Database Proxy affected versions not specified Description Remote authenticated attackers can execute arbitrary code with root privileges on affected installations. The issue stems from the lack of proper neutralization of CRLF...

MiracleLinux 9 : webkit2gtk3-2.52.4-1.el9_8 (AXSA:2026-1338:05)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1338:05 advisory. webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash CVE-2026-28946 webkitgtk: Processing maliciously crafte...

PT-2026-63604

Name of the Vulnerable Software and Affected Versions Cache Cleaner Pro extension for Joomla affected versions not specified Description CDN credentials are exposed within administrator request URLs, potentially allowing unauthorized access to the Content Delivery Network configuration...

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

Impact A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issu...

GHSA-Q8WF-6R8G-63CH Next.js: Denial of Service in the Image Optimization API using SVGs

Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, they can cause CPU exhaustion in /next/image endpoints. - If you are using...

Next.js: Denial of Service in the Image Optimization API using SVGs

Impact When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, they can cause CPU exhaustion in /next/image endpoints. - If you are using...