Cross-site Scripting (XSS)

Craft CMS is vulnerable to Stored cross-site scripting XSS. The vulnerability is due to improper escaping of entry titles during drag-and-drop operations, where user-controlled titles are decoded and inserted into HTML without proper sanitization, allowing attackers to execute arbitrary JavaScrip...

SUSE-SU-2026:2839-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work bsc1255416. - CVE-2026-43198: tcp: fix potential race in tcpv6synrecvsock bsc1264610. ...

WordPress Super Forms – Drag & Drop Form Builder plugin <= 6.3.313 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by andrea bocchetti in WordPress Plugin Super Forms versions = 6.3.313...

CVE-2026-15288: Improper Input Validation

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data in the 'createpaymentintent' and...

CVE-2026-14894: Unrestricted Upload of File with Dangerous Type

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submitform function. This is due to missing file type validation and the absence of any capability check on the submitform nopriv AJAX...

GHSA-HM42-Q32M-VJ4F Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Summary The modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an...

Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Summary The modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an...

Fake 7-Zip Installers Turn Devices Into Residential Proxy Nodes

Cybersecurity researchers have disclosed details of a new threat actor dubbed Lurking Lizard that has been operating an end-to-end malicious residential proxy business using an infrastructure comprising more than 230 lookalike domains. The activity dates back to at least August 2022, according to...

PT-2026-56854

Name of the Vulnerable Software and Affected Versions Admidio versions prior to 5.0.11 Description The 'modules/plugins.php' endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF Cross-Site Request Forgery token validation. CSRF is a type of...

OPENSUSE-SU-2026:21277-1 Security update for go-sendxmpp

This update for go-sendxmpp fixes the following issues: Changes in go-sendxmpp: - Update to 0.16.0: Added: Add Ox support to http-upload. Add Ox support for private group chats. Show error cause if joining MUCs failedi requires go-xmpp = v0.3.5. Changed: Fix --ox-delete-nodes. Fix receiving of 1-...

Eventlet affected by HTTP request smuggling in unparsed trailers

ImpactThe Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections.This vulnerability could enable attackers to:- Bypass front-end security controls- Launch targeted attacks against active site users- Poison web caches PatchesProblem has been...

GO-2026-5847 Kahi has privilege-drop and socket/log permission issues in github.com/kahiteam/kahi

Kahi has privilege-drop and socket/log permission issues in github.com/kahiteam/kahi...

copyparty renders unsanitized filenames as HTML when user uploads empty files

SummaryA DOM-Based XSS was discovered in copyparty, a portable fileserver. The vulnerability is considered low-risk. DetailsBy handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the...

PYSEC-2026-1278 copyparty renders unsanitized filenames as HTML when user uploads empty files

Summary A DOM-Based XSS was discovered in copyparty, a portable fileserver. The vulnerability is considered low-risk. Details By handing someone a maliciously-named file, and then tricking them into dragging the file into copyparty's Web-UI, an attacker could execute arbitrary javascript with the...

RUSTSEC-2026-0205 `Array::insert` violates exception safety if compare function panics, leading to potential Double-Free

In affected versions of this crate, Array::insert is not exception safe. In the UPSERT path, key and value's snapshot is written to self.datablock, and after the insertion is completed, key and value are mem::forget in order to prevent double free. However, during the insertion, K::compare is...

`Array::insert` violates exception safety if compare function panics, leading to potential Double-Free

In affected versions of this crate, Array::insert is not exception safe. In the UPSERT path, key and value's snapshot is written to self.datablock, and after the insertion is completed, key and value are mem::forget in order to prevent double free. However, during the insertion, K::compare is...

`let_cxx_string!` uses uninitialized value due to exception safety violations

In affected versions of this crate, letcxxstring! is not exception safe. After creating the StackString, if match $value panics, the content of StackString is not yet initialized, while the drop implementation of StackString unconditionally deinitializes the content, leading to use of uninitializ...

CVE-2026-53359

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad "KVM: x86: Fix shadow paging use-after-free due to unexpected GFN" fixed a shadow paging mismatch between stored and computed GFNs; the bug...

CVE-2026-53359

CVE-2026-53359 is a KVM/x86 shadow MMU use-after-free caused by a role mismatch when reusing shadow pages during a nested walk. The flaw arises when a PDE is modified and a 4KB leaf SPTE is installed on the new path, but the parent 2MB page’s direct flag and the shadow page’s role may not align, ...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : cifs-utils vulnerability (USN-8496-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8496-1 advisory. It was discovered that cifs-utils incorrectly dropped root privileges before looking up user information. A local attacker could...