Wagtail: Reflected XSS in dynamic image URL generator view

Impact A reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform...

Wagtail: Pages translations can be created without page permissions when using simple_translation

Impact A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for. Patches Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2. Workarounds N/A Acknowledgements Many thanks to @devansh3008 and...

Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...

Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password check

Summary MyAccountController::postAccountInfoForm allows an authenticated user to update the authentication column default: email without verifying their current password. Because email is the account-recovery anchor, this enables account takeover after the attacker's session ends: the new email...

CVE-2026-54623

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

CVE-2026-74339

A flaw was found in the ALSA Advanced Linux Sound Architecture sequencer component of the Linux kernel. A local attacker, by writing a direct variable event to itself, can read back a kernel memory address from the returned event header. This information disclosure could potentially be used to...

CVE-2026-66788 Lighthouse: lighthouse: arbitrary local-namespace injection via attacker-controlled labelsourcenamespace

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

EUVD-2026-63535

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

CVE-2026-66788

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

CVE-2026-15743

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The servestatic method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be stored in a shared cache, and may be reused i...

EUVD-2026-63533

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

CVE-2026-53569

In Frappe framework ≤16.31.0, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py skip read-permission checks before modifying _liked_by metadata or a Note's seen state. An authenticated low-privilege user can thus probe for resource ...

EUVD-2026-63574

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted togglelike and markasseen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying likedby metadata or a Note seen state. An authenticated...

CVE-2026-63003

A staff user with only "add page" permission can POST a crafted source page ID to the duplicate endpoint, copying all placeholders/plugins of an unauthorized page and stripping its view restrictions, exposing restricted or cross-site content. The fix adds an object-level user_can_view_page() chec...

CVE-2026-54624

In django CMS before 5.0.8, the structure endpoint in cms/views.py renders structure.html without calling user_can_view_page(), unlike edit/preview endpoints. A low-privileged staff user can read restricted pages' plugin short descriptions (link names, URLs, snippets) when CMS_PERMISSION=True and...

CVE-2026-66788

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

CVE-2026-64846

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

CVE-2026-74317

A flaw was found in the Linux kernel's ixgbe network driver. This vulnerability occurs when configuring eXpress Data Path XDP queues on systems with a high number of CPUs and specific network adapters. An attacker could potentially trigger a memory corruption issue by exploiting the incorrect...

CVE-2026-74313

A flaw was found in the Linux kernel's vduse component. A race condition in the vdusedevopen function allows a memory object to be freed while still in use. This use-after-free vulnerability could enable a local attacker to cause a system crash denial of service or potentially execute arbitrary...

EUVD-2026-63464

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged cod...