Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

SummaryAdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request.If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's G...

EUVD-2026-75365

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399

The Redux Framework WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Slider field in User Profile settings in versions up to and including 4.5.13.1 . The root cause involves three factors: insufficient input sanitization in the user_meta_save() function (which only sani...

CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CLEANSTART-2026-CL03013 Netty is an asynchronous, event-driven network application framework

Multiple security vulnerabilities affect the apache-hive package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-BR58082 Echo is a Go web framework

Multiple security vulnerabilities affect the kube-metrics-adapter package. Echo is a Go web framework. See references for individual vulnerability details...

CVE-2026-5399: Improper Neutralization of Input During Web Page Generation

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

PT-2026-89338

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user meta save function which only sanitizes array values, not scalar...

Empire v7.0.2

Empire Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. The Empire server is written in Python 3 and is modular to allow operator flexibility. Empire comes built-in with a client that can be used remotely to access the server...

EUVD-2026-74954

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2026-64857 tirreno has Session Fixation in Login Authentication

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2026-64857 tirreno has Session Fixation in Login Authentication

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.3.25 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.2.31 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

Linux Distros Unpatched Vulnerability : CVE-2026-82073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks...

Linux Distros Unpatched Vulnerability : CVE-2026-82074

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a special...

CVE-2026-53638 Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The PATCH /api/v2/shop/account/orders/tokenValue/payments/paymentId endpoint, used by an...

CVE-2026-53933

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

EUVD-2026-74284

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...