Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose arbitrary files readable by the PHP process by injecting @import inline "" directives into LESS source that the backend compiles. Four entry points share the same root cause: - Bran...

CVE-2026-62670 Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An...

EUVD-2026-60793

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-68315 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68315 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64580 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-64580 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-56289 affecting package patch for versions less than 2.7.6-10

CVE-2026-56289 affecting package patch for versions less than 2.7.6-10. A patched version of the package is available...

Winter: Stored XSS through Editor Settings custom styles

Impact Authenticated Backend Users with the backend.manageeditor "Manage editor settings" permission can provide custom styles through Settings → Editor Settings → Markup Styles that are compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was n...

Winter: Stored XSS through Brand Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" permission can provide custom CSS through Settings → Customize Backend → Styles that is compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was not sanitized, which could hav...

NPM: Mermaid configuration APIs allow prototype pollution

NPM: Mermaid configuration APIs allow prototype pollution vulnerability discovered by ? in WordPress Npm mermaid versions 10.9.8...

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions 6.54.1...

CVE-2026-54365 CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

CVE-2026-65883

Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution...

CVE-2026-65883

CVE-2026-65883 affects Joomla extensions: aimy-extensions.com ’s Captcha-Less Form Guard versions 18.0–20.0 . The issue is a PHP object injection in a forged clfgd field, leading to remote code execution . The root cause and impact are described as RCE with high severity. No explicit exploit deta...

CVE-2026-42770 affecting package openssl for versions less than 3.3.7-4

CVE-2026-42770 affecting package openssl for versions less than 3.3.7-4. A patched version of the package is available...

PT-2026-58808

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.18.0 through 2.18.8 jackson-databind versions 2.21.0 through 2.21.4 jackson-databind versions 2.22.0 through 2.22.0 jackson-databind versions 3.1.0 through 3.1.4 jackson-databind versions 3.2.0 through 3.2.0...

PYSEC-2026-3383 FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess

Impact An input poolingratio that is smaller than 1 will trigger a heap OOB in tf.rawops.FractionalMaxPool and tf.rawops.FractionalAvgPool. Patches We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cher...

CVE-2026-13236 AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056

Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source due to improper validation of the interaction between DisableForwarding and PermitTunnel settings. An attacker can enable unauthorized tunneling by exploiting a misconfiguration where DisableForwarding does no...

Foxit PDF Editor for Mac < 13.2.5 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor for Mac application previously named Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 13.2.5. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on...

PYSEC-0000-CVE-2026-49297

Apache Airflow's Google provider operators GCSToSFTPOperator and GCSTimeSpanFileTransformOperator joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with write access to the source GCS bucket...