CVE-2026-53611 Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC ConnectRPC API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there ...

Improper Input Validation

nanoid is vulnerable to Improper Input Validation. The vulnerability is due to improper coercion of the user-influenced size parameter to a signed 32-bit integer, which allows an attacker to corrupt the process-wide CSPRNG pool and cause subsequent tokens and unique identifiers to become...

EUVD-2026-70139

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...

CVE-2026-66362 NGF vulnerability

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...

CVE-2026-66362

CVE-2026-66362 is a configuration injection vulnerability in the NGINX configuration generator component of NGINX Gateway Fabric . When NGINX Plus is configured as the data plane, user-supplied values from the AuthenticationFilter CRD (clientID, cookieName) or the clientSecret field of a referenc...

CVE-2026-84648

Jenkins versions 2.579 and earlier , and LTS 2.568.2 and earlier , are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is that the system log viewer fails to escape log record metadata, specifically the source, level, and timestamp . This flaw is exploitable by att...

Improper Input Validation

Engine.IO is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of the WebTransport session ID, which allows an unauthenticated remote attacker to trigger a TypeError and crash the Node.js server process, causing denial of service...

CVE-2026-2811

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

GHSA-W2QP-RPH6-63G4 fastify vulnerable to schema validation bypass via root primitive coercion mismatch

Impact fastify before 5.12.1, when a route uses a root-level primitive body schema for example an integer with a minimum and maximum and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced ...

SUSE-SU-2026:3924-1 Security update for texlive

This update for texlive fixes the following issue: - CVE-2026-63729: heap use-after-free in the SyncTeX parser can lead to application crash or arbitrary code execution when malformed .synctex or .synctex.gz files are processedbsc1272432...

GHSA-CW6X-M8JW-QMRH NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

Summary nltk.featstruct.FeatStructReader used by FeatStructstr and by FeatureGrammar.fromstring parses feature-structure strings such as a=1 with a recursive-descent parser that has no nesting-depth limit. A small, trivially-crafted input 700 bytes with deeply nested brackets drives the parser pa...

NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

Summary nltk.featstruct.FeatStructReader used by FeatStructstr and by FeatureGrammar.fromstring parses feature-structure strings such as a=1 with a recursive-descent parser that has no nesting-depth limit. A small, trivially-crafted input 700 bytes with deeply nested brackets drives the parser pa...

GHSA-CVHV-G4RQ-3HMW ImageMagick: Memory Leak when providing invalid options to the cli

A memory leak is possible when invalid options are passed to the cli magick...

kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

A flaw was found in the Linux kernel's CIFS Common Internet File System client. When the cifssanitizeprepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-boun...

EUVD-2026-70050

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2811

The Ajaxify Comments WordPress plugin before version 3.2 is affected by an HTTP Header Injection vulnerability caused by insufficient input sanitization and output escaping on user-supplied data. Unauthenticated attackers can inject arbitrary HTTP headers, resulting in low confidentiality and int...

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-2811 Ajaxify Comments < 3.2 - Unauthenticated HTTP Header Injection

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

EUVD-2025-210831

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...

CVE-2025-15489 Passster < 4.2.24 - Password Protection Bypass

The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content...