Security Advisory 0167

Security Advisory 0167 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73445 CVSSv3.1 Base Score: 4.9...

PT-2026-89264

Name of the Vulnerable Software and Affected Versions Builderall for WordPress versions prior to 3.0.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping in the Photo Module attributes setting. This allows authenticated attackers with...

Security Advisory 0155

Security Advisory 0155 . CSAF PDF Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-19655 CVSSv3.1 Base Score: 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSSv4.0 Base Scor...

ROS-20260909-73-0082

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260909-73-0028

The vulnerability in Chromium is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...

PT-2026-88763

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq tree tree chart template' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-89263

Name of the Vulnerable Software and Affected Versions Builderall for WordPress versions prior to 3.0.3 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary we...

PT-2026-88762

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm contact dropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This mak...

PT-2026-88897

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl user preference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for...

ROS-20260909-73-0133

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-88822

Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory...

PT-2026-88823

Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory...

PT-2026-88835

Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege...

PT-2026-88828

Improper input validation in wpa supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: iperf3 (UTSA-2026-106773)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106773 advisory. A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control- channel JSON with oversized numeric parameters, such as...

CVE-2026-21088: Improper Input Validation

Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21094: Improper Input Validation

Improper input validation in wpasupplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory...

CVE-2026-21089: Improper Input Validation

Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21101: Improper Input Validation

Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege...

PT-2026-88910

Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Reservation System allows Input Data Manipulation. This issue affects Library Reservation System: before v22.2...