NPM: gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

NPM: gettext-converter: Prototype pollution in js2i18next via crafted translation keys vulnerability discovered by ? in WordPress Npm gettext-converter versions 1.3.3...

gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. protogcPolluted causes the converter to resolv...

@gluuten/gluuten-cli (0.9.5), @open-xchange/vite-plugin-i18next-gettext (>=0.0.1, <=0.0.4) +2 more potentially affected by CVE-2026-55451 via gettext-converter (>=1.0.3, <=1.3.2)

gettext-converter NPM version =1.0.3, =0.0.1, =7.1.0, =4.11.2, =4.18.0 Source cves: CVE-2026-55451 Source advisory: OSV:GHSA-F4JP-RW7W-CCWG...

GHSA-F4JP-RW7W-CCWG gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. protogcPolluted causes the converter to resolv...

PT-2026-80769

Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. proto gcPolluted causes the converter to resol...

CVE-2026-75981 TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

PT-2026-78311

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translate page in...

CVE-2026-75981: Improper Neutralization of Input During Web Page Generation

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

appfinder (>=0.1.0, <=0.1.2), breezy (3.3.4) +25 more potentially affected by unknown CVE via gettext-rs (>=0.4.4, <=0.7.7)

gettext-rs CARGO version =0.4.4, =0.1.0, =0.0.4, =0.4.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.2.0, =0.0.7, =1.1.0, =0.1.0, =0.5.0, =0.5.0, =0.6.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0244...

CVE-2026-18510: Improper Neutralization of Input During Web Page Generation

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content URL-encoded gettext markers in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This make...

Photon OS 5.0: Gettext PHSA-2025-5.0-91-0485

An update of the gettext package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0485. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Astra Linux – Vulnerability in grub2

A vulnerability related to operations after freeing memory has been discovered in GRUB’s gettext module. This flaw arises from a programming error where the gettext command remains registered in memory even after its associated module is unloaded. An attacker can exploit this condition by invokin...

Security Bulletin: Vulnarability in grub2 library (CVE-2025-61662) affects Power HMC.

Summary The grub2 library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-61662 DESCRIPTION: A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the...

Typecho-GetText-eval-RCE-PoC

Typecho GetText Plural-Forms eval Remote Code Execution...

RockyLinux 8 : grub2 (RLSA-2026:4648)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:4648 advisory. grub2: Missing unregister call for gettext command may lead to use-after-free CVE-2025-61662 Tenable has extracted the preceding description block directly from t...

RockyLinux 10 : grub2 (RLSA-2026:4649)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:4649 advisory. grub2: Missing unregister call for gettext command may lead to use-after-free CVE-2025-61662 Tenable has extracted the preceding description block directly from...

RockyLinux 9 : grub2 (RLSA-2026:4760)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:4760 advisory. grub2: Missing unregister call for gettext command may lead to use-after-free CVE-2025-61662 Tenable has extracted the preceding description block directly from t...

grub2 security update

An update is available for grub2. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a...

RLSA-2026:4649 Moderate: grub2 security update

The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fixes: grub2: Missing...

RLSA-2025:20532 Moderate: grub2 security update

The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fixes: grub2:...