MAL-2026-10560 Malicious code in clipboard-drop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea807812d5f872524eab6c57931788239310050ffb4c477643977def9dac8fb9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

[SECURITY] Fedora 44 Update: python-idna-3.18-1.fc44

A library to support the Internationalised Domain Names in Applications IDNA protocol as specified in RFC 5891 . This version of the protocol is often referred to as "IDNA2008" and can produce different results from the earlier standard from 2003. The library is also intended to act as a suitable...

Cross-site Scripting (XSS)

Craft CMS is vulnerable to Stored cross-site scripting XSS. The vulnerability is due to improper escaping of entry titles during drag-and-drop operations, where user-controlled titles are decoded and inserted into HTML without proper sanitization, allowing attackers to execute arbitrary JavaScrip...

SUSE-SU-2026:2839-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work bsc1255416. - CVE-2026-43198: tcp: fix potential race in tcpv6synrecvsock bsc1264610. ...

WordPress Super Forms – Drag & Drop Form Builder plugin <= 6.3.313 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by andrea bocchetti in WordPress Plugin Super Forms versions = 6.3.313...

CVE-2026-14894: Unrestricted Upload of File with Dangerous Type

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submitform function. This is due to missing file type validation and the absence of any capability check on the submitform nopriv AJAX...

CVE-2026-15288: Improper Input Validation

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data in the 'createpaymentintent' and...

Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Summary The modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an...

GHSA-HM42-Q32M-VJ4F Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Summary The modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an...

Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes

Cybersecurity researchers have disclosed details of a new threat actor dubbed Lurking Lizard that has been operating an end-to-end malicious residential proxy business using an infrastructure comprising more than 230 lookalike domains. The activity dates back to at least August 2022, according to...

PT-2026-56854

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.11 Description The 'modules/plugins.php' endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF Cross-Site Request Forgery token validation. CSRF is a type of...

OPENSUSE-SU-2026:21277-1 Security update for go-sendxmpp

This update for go-sendxmpp fixes the following issues: Changes in go-sendxmpp: - Update to 0.16.0: Added: Add Ox support to http-upload. Add Ox support for private group chats. Show error cause if joining MUCs failedi requires go-xmpp = v0.3.5. Changed: Fix --ox-delete-nodes. Fix receiving of 1-...

Eventlet affected by HTTP request smuggling in unparsed trailers

ImpactThe Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.This vulnerability could enable attackers to:- Bypass front-end security controls- Launch targeted attacks against active site users- Poison web caches PatchesProblem has been...

GO-2026-5847 Kahi has privilege-drop and socket/log permission issues in github.com/kahiteam/kahi

Kahi has privilege-drop and socket/log permission issues in github.com/kahiteam/kahi...

copyparty renders unsanitized filenames as HTML when user uploads empty files

SummaryA DOM-Based XSS was discovered in copyparty, a portable fileserver. The vulnerability is considered low-risk. DetailsBy handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the...

PYSEC-2026-1278 copyparty renders unsanitized filenames as HTML when user uploads empty files

Summary A DOM-Based XSS was discovered in copyparty, a portable fileserver. The vulnerability is considered low-risk. Details By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the...

RUSTSEC-2026-0205 `Array::insert` violates exception safety if compare function panics, leading to potential Double-Free

In affected versions of this crate, Array::insert is not exception safe. In the UPSERT path, key and value's snapshot is written to self.datablock, and after the insertion is completed, key and value are mem::forget in order to prevent double free. However, during the insertion, K::compare is...

CVE-2026-53359

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad "KVM: x86: Fix shadow paging use-after-free due to unexpected GFN" fixed a shadow paging mismatch between stored and computed GFNs; the bug...

CVE-2026-53359

CVE-2026-53359 is a KVM/x86 shadow MMU use-after-free caused by a role mismatch when reusing shadow pages during a nested walk. The flaw arises when a PDE is modified and a 4KB leaf SPTE is installed on the new path, but the parent 2MB page’s direct flag and the shadow page’s role may not align, ...

Oracle Linux 9 : mariadb:10.11 (ELSA-2026-33482)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-33482 advisory. galera 26.4.20-1.0.1 - Drop nmap-ncat requirement. Orabug: 34116228 - Requirement to delete garbd-wrapper script and lp1184034 test case without using patches...