CVE-2026-78074

CVE-2026-78074 affects the free versions of various miniOrange Joomla extensions. A missing authentication check allows unauthenticated actors to deinstall arbitrary installed extensions , resulting in high integrity and availability impact on the vulnerable system. The CVSS 4.0 score is 8.8 (HIG...

EUVD-2026-68878

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILENAME value used by setfilename and loadmetadata in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILENAME value with the settings director...

CVE-2026-79407

CVE-2026-79407 is a path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 . The vulnerable code resides in metagpt/ext/spo/utils/load.py, where set_file_name() and load_meta_data() join an attacker-controlled FILE_NAME value with the settings directory and open the resulting path wit...

RockyLinux 9 : php (RLSA-2026:61259)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61259 advisory. php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escapin...

CVE-2026-82450 BookStack before 26.05.4 Remote Code Execution via Book Cover

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP fil...

PT-2026-83429

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4 Description An authenticated remote code execution issue exists in the portable ZIP import functionality. Users possessing both Import Content and Create Books permissions can upload a PHP-image polyglot...

Malicious code in npm-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a6c4f2b94932e8bcb68c0a146d536b7e3a00d48041aa5a6fc9edf9f82ae5244 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/npm-extension rather than a registry version range. ...

MAL-2026-15515 Malicious code in npm-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a6c4f2b94932e8bcb68c0a146d536b7e3a00d48041aa5a6fc9edf9f82ae5244 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/npm-extension rather than a registry version range. ...

GHSA-9272-WG2R-7XMX Yamcs has DOM XSS in Extension Routing

Attack type: Unauthenticated remote Impact: Execution of arbitrary JavaScript in a user’s browser. Affected components: extension.matcher.ts:12, extension.component.ts:40, app.component.ts:134. Yamcs is vulnerable to cross-site scripting in the /ext URL endpoint. By inputting specially crafted co...

EUVD-2026-67845

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-55566 Yamcs: DOM XSS in Extension Routing

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-55566 Yamcs: DOM XSS in Extension Routing

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-55566

Yamcs , a mission control framework, is affected by a DOM XSS in the /ext URL route (affected versions prior to 5.12.8 and 5.13.2 ). The root cause is that attacker-controlled data in files extension.matcher.ts, extension.component.ts, and app.component.ts is rendered via innerHTML without valida...

SUSE CVE-2026-14457

Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated certificate configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted...

SUSE CVE-2026-80636

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: revert ct extension genid infrastructure This infrastructure is not used anymore after moving ct timeout and helper to use datapath refcount to track object use. Revert commit c56716c69ce1 "netfilter:...

Chromium: CVE-2026-79137 Incorrect authorization in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-78073

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors...

CVE-2026-78072

Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded 5.6.1...

CVE-2026-78071

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78070

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles...