CVE-2026-3278 XSS Vulnerability discovered in OpenText™ ZENworks Service Desk.

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in OpenText™ ZENworks Service Desk allows Cross-Site Scripting XSS. The vulnerability could allow an attacker to execute arbitrary JavaScript leading to unauthorized actions on behalf of the user.This...

Malicious code in phx-core5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b50389bf1ccd774bf7ef41ddc301049375776e994f84731a4baf15104bdbd7a The package phx-core5 was found to contain malicious code...

MAL-2026-1814 Malicious code in phx-core5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b50389bf1ccd774bf7ef41ddc301049375776e994f84731a4baf15104bdbd7a The package phx-core5 was found to contain malicious code...

EUVD-2026-12800

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clonebulkactionhandler and republishrequest functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with...

WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.9.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by johska in WordPress Plugin Print Invoice & Delivery Notes for WooCommerce versions = 5.9.0...

CVE-2026-1217 Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clonebulkactionhandler and republishrequest functions in all versions up to, and including, 4.5. This makes it possible for authenticated attackers, with...

SUSE-SU-2026:0917-1 Security update for kubernetes

This update for kubernetes rebuilds it against the current go 1.25 security release...

CVE-2026-32608

Glances CVE-2026-32608 describes a local command-injection in the action system. Before 4.5.2, Mustache-rendered values such as process names, mount points, or container names could contain shell metacharacters that are not safely handled by secure_popen(), causing unintended command splitting. A...

CVE-2026-31891

CVE-2026-31891 affects Cockpit CMS 2.13.4 and earlier with API access enabled. A SQL injection in the MongoLite Aggregation Optimizer allows an attacker with a valid read-only API key to inject arbitrary SQL via unsanitized field names in aggregation queries (toJsonExtractRaw()), bypassing the pu...

CVE-2026-28674

Product/Context: xiaoheiFS (self-hosted financial/operational system). Vulnerability: In versions ≤ 0.3.15, the AdminPaymentPluginUpload endpoint allows admins to upload any file to plugins/payment/ with only a hardcoded password (qweasd123456) and disregards file content. A background watcher (S...

CVE-2026-29057 Next.js: HTTP request smuggling in rewrites

Next.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted DELETE/OPTIONS request using Transfer-Encoding: chunked could trigger request boundary...

CVE-2026-27894

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with...

CVE-2026-27895

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type including .php files can be uploaded. With...

DEBIAN-CVE-2026-27894

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with...

PT-2026-26167

Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch server-side, and returns the...

PT-2026-26022

The WP Go Maps formerly WP Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpgmza custom js’ parameter in all versions up to, and including, 10.0.05 due to insufficient input sanitization and output escaping and missing capability check in the 'admin post...

Security update for krb5-appl (critical)

openSUSE security update: security update for krb5-appl ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20374-1 Rating: critical References: bsc1259691 Cross-References: CVE-2026-32746 CVSS scores: CVE-2026-32746 SUSE : 9.8...

Jenkins security vulnerabilities

Jenkins is an open-source application developed by Jenkins Project. The open-source automation server Jenkins offers hundreds of plugins to support building, deploying, and automating any project. Jenkins versions 2.554 and earlier, as well as LTS 2.541.2 and earlier, have security vulnerabilitie...

PT-2026-26176

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 1.2.2 Description free5GC CHF has an out-of-bounds slice access issue within the nchf-convergedcharging service. A valid, authenticated request to the /nchf-convergedcharging/v3/recharging/:ueId?ratingGroup=... API...

LDAP Account Manager security vulnerabilities

LDAP Account Manager LAM is an open-source web frontend for managing entries stored in LDAP directories, such as users, groups, and DHCP settings. Prior to version 9.5 of LDAP Account Manager, there was a security vulnerability due to the PDF export component not properly verifying the file...