CVE-2026-16068

The Brizy - Page Builder WordPress plugin (versions prior to 2.8.19 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper restriction on who can modify site-global design data and a failure to sanitize specific data before it is output. This allows authenticated us...

CVE-2026-16068

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

CVE-2026-16068: Improper Neutralization of Input During Web Page Generation

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

PT-2026-67890

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.6 OpenSIPS versions prior to 4.0.0-rc1 Description The construct uri function concatenates URI components including protocol, username, domain, port, and params into a fixed 1024-byte global BSS buffer without...

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in Cassandra Reaper 4.0

Summary IBM Sterling Global Availability Mailbox uses Cassandra Reaper 4.0, which is affected by privilege escalation CVE-2026-27314 and resource consumption CVE-2026-32588 vulnerabilities. Vulnerability Details CVEID:CVE-2026-27314 DESCRIPTION: Privilege escalation in Apache Cassandra 5.0 on an...

CVE-2026-69094

Admidio before 5.0.11 is affected by CVE-2026-69094: an insecure direct object reference in the save_temporary mode of mylist_function.php allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users’ p...

CVE-2026-69094 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-69094 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-69094 Admidio before 5.0.11 IDOR via save_temporary mylist_function.php

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user

A flaw was found in MariaDB server. A high-privileged MariaDB user could exploit this vulnerability by manipulating specific global system variables, namely wsrepsstreceiveaddress or wsrepsstdonor. This manipulation could allow the user to execute arbitrary shell commands as the user ID of the...

CVE-2026-67330

The CVE affects @better-auth/scim (the better-auth SCIM plugin). Versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9 contain an authorization bypass caused by SCIM token issuance using provider IDs that collide with existing SSO/SAML/OIDC/generic OAuth/social provider name...

CVE-2026-67330

@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...

Malicious code in @global-theme/context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b48962d911b70fd09f4c001b44b879452dda607f877256d2f85d64538912ab7f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @global-theme/context is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11439 Malicious code in @global-theme/context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b48962d911b70fd09f4c001b44b879452dda607f877256d2f85d64538912ab7f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Summary String.prototype.match with a global RE2 collects all matches in a native loop that advances the cursor by the match length. A zero-width empty match has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any patter...

EUVD-2026-51298

re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth DoS...

GHSA-6HXR-MR5R-9836 re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

Summary String.prototype.match with a global RE2 collects all matches in a native loop that advances the cursor by the match length. A zero-width empty match has length 0, so the cursor never advances: the same empty match is found forever and appended to an ever-growing native vector. Any patter...