SUSE CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j CVE-2026-23845, "Server-Side Request Forgery SSRF via HTML Check API", shipped in mailpit v1.28.3, hardened internal/htmlcheck/css.go::downloadCSSToBytes with a 5MB size cap, a text/css content-type check,...

SUSE CVE-2026-52807

Gogs is an open source self-hosted Git service. Prior to 0.14.3, in newform.tmpl, milestone names are rendered with Go's default auto-escaping .Name, which converts to etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the...

SUSE CVE-2026-55437

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded...

SUSE CVE-2026-56389

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML-to-HTML transformation step via %define tool.xsltproc, which is accepted without...

JLSEC-2026-947 ImageMagick: Code Injection via PostScript header in ps coders

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the ps coders, responsible for writing PostScript files, fails to sanitize the input before writing it into the PostScript header. An attacker can provide a...

SUSE-SU-2026:3414-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. - CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument bsc1272582. - CVE-2026-62946: integer...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bit...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bit...

CVE-2026-13344

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...

EUVD-2026-50995

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

CVE-2026-16610

The Admin and Site Enhancements ASE Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursivehtml function. This is due to the frontend save handler enforces only a publicly emitted nonce with no authentication check, CAPTCHA...

CVE-2026-18019

Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-18016

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-18017

Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-18013

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-18013

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2026-18017

Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-18015

Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

CVE-2026-18007

Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-18004

Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...