[SECURITY] Fedora 43 Update: curl-8.15.0-8.fc43

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

CVE-2026-14331: Improper Neutralization of Input During Web Page Generation

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...

CVE-2026-12801: Improper Neutralization of Input During Web Page Generation

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

PT-2026-68851

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.44 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject...

PT-2026-69048

Name of the Vulnerable Software and Affected Versions Weaver Fanwei E-cology 9.0 versions prior to 10.52 Description A file upload issue allows a remote, unauthenticated attacker to upload arbitrary files, such as JSP webshells. This is achieved by submitting a multipart/form-data POST request to...

CVE-2022-4995: Unrestricted Upload of File with Dangerous Type

Weaver Fanwei E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary...

CVE-2026-54338: Uncontrolled Resource Consumption

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

Node.js Module axios 0.31.1 < 0.33.0 / 1.15.1 < 1.18.0 DoS (CVE-2026-67321)

The version of the axios Node.js module installed on the remote host is 0.31.1 prior to 0.33.0 or 1.15.1 prior to 1.18.0. It is, therefore, affected by a vulnerability: - An incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who...

Node.js Module axios 0.28.0 < 0.33.0 / 1.x < 1.18.0 DoS

The version of the axios Node.js module installed on the remote host is 0.28.0 prior to 0.33.0 or 1.x prior to 1.18.0. It is, therefore, affected by multiple vulnerabilities: - Uncontrolled recursion in formDataToJSON when an application passes attacker-controlled FormData field names with...

Security Bulletin: IBM z/TPF Development is affected by multiple vulnerabilities

Summary Multiple vulnerabilities were identified in the open-source package axios which provides the HTTPS/HTTP client used by the IBM z/TPF Development extension. Fixes for these vulnerabilities were made available in axios version 1.18.0. Vulnerability Details CVEID:CVE-2026-67312 DESCRIPTION:...

CVE-2026-71435

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

CVE-2026-15256

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so...

CVE-2026-13342

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeati...

Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Impact The default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients Patches This has been fixed in 5.74.3 and 6.24.2...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the email notification rendering process. An attacker can inject arbitrary HTML content into notification emails sent to recipients by submitting specially crafted input values through a form. Details...

GHSA-VX89-P3J7-8XQC Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Impact The default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients Patches This has been fixed in 5.74.3 and 6.24.2...

CVE-2026-71435

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

EUVD-2026-54239

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

CVE-2026-71435 Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...

CVE-2026-71435 Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.3 and 6.24.2, the default "automagic" form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the...