WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability discovered by Pham Duc Anh in WordPress Plugin Asset CleanUp: Page Speed Booster versions = 1.4.0.5...

BIT-PYTHON-MIN-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

BIT-PYTHON-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

BIT-LIBPYTHON-2026-82049 tarfile extraction filters allow file modification and content disclosure via hard link to symlink

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

WordPress To Do List Member plugin 1.4-1.6 - Unauthenticated Content Injection vulnerability

Unauthenticated Content Injection vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin To Do List Member versions 1.4-1.6...

CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

CVE-2026-86802 To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site...

CVE-2026-86802

To Do List Member is a WordPress plugin that allows unauthenticated users to create arbitrary published posts and taxonomy terms due to missing authorization and nonce checks in its import routine. The plugin also fails to validate the source location it fetches imported data from, enabling unaut...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process termination due to improper state management...

webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling...

abrt: unsanitized systemd journal content written to dump directory files enables content injection

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A...

Important: Red Hat Security Advisory: abrt security update

An update for abrt is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

Important: Red Hat Security Advisory: abrt security update

An update for abrt is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

abrt: unsanitized systemd journal content written to dump directory files enables content injection

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A...

abrt: unsanitized systemd journal content written to dump directory files enables content injection

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A...

CVE-2026-94110

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-94103

A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/sitepagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been...

CVE-2026-94110 QCMS Content Detail Controllers.php self_Tmp sql injection

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...

EUVD-2026-83822

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...