SUSE CVE-2026-82330

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ compressed decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to ...

SUSE CVE-2026-82591

A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. The impacted element is the function MD5Importer::MakeDataUnique of the file code/AssetLib/MD5/MD5Loader.cpp. The manipulation of the argument iNewIndex leads to heap-based buffer overflow. The attack can...

EUVD-2026-68517

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every...

CVE-2026-76986 Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every...

CVE-2026-76986 Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every...

CVE-2026-76986

Apache Wicket's AbstractSingleSelectChoice (base class of DropDownChoice ) writes the default option body — rendered when no choice is selected — into markup without escaping , while all other options respect the escape-model-strings setting. The unescaped value originates from the protected meth...

CVE-2026-76985

Apache Wicket is affected by a reflected XSS in the Palette component (AbstractOptions). The root cause is that attribute names and values returned by getAdditionalAttributes were written directly into tags without escaping. The vulnerability is only exploitable when an application overrides Pal...

CVE-2026-76985 Apache Wicket: XSS in Palette via getAdditionalAttributes

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings...

EUVD-2026-68516

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings...

CVE-2026-76985 Apache Wicket: XSS in Palette via getAdditionalAttributes

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings...

CVE-2026-82694

A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be...

CVE-2026-74010

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14...

CVE-2026-5956

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026...

CVE-2026-12894

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-82697

CVE-2026-82697 affects the sambitraj Student-Management-System (a rolling-release GitHub project) up to commit 56ba287. The vulnerable component is the session_start function, which sets a session cookie without the httponly flag , allowing JavaScript access to the session cookie. The attack is r...

CVE-2026-82697 sambitraj Student-Management-System session_start cookie httponly flag

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function sessionstart. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity...

EUVD-2026-68515

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function sessionstart. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity...

CVE-2026-82697 sambitraj Student-Management-System session_start cookie httponly flag

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function sessionstart. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity...

USN-8704-1 cpio vulnerabilities

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the...

USN-8704-1: GNU cpio vulnerabilities

It was discovered that cpio incorrectly sanitized hard-link targets when extracting tar archives in copy-in mode. If a user or automated system were tricked into extracting a specially crafted tar archive, an attacker could possibly use this issue to create hard links to files outside the...