EUVD-2026-64219

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

PT-2026-79510

Name of the Vulnerable Software and Affected Versions ManageWP Worker versions prior to 4.9.37 Description An authentication bypass exists because the plugin fails to bind the account being logged in to the signature that authorizes the login. Additionally, the system does not prevent the replay ...

PT-2026-79724

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix qentry overwrite for CONFIRM LINK and ADD LINK CONT in smc llc event handler The SMC LLC CONFIRM LINK / SMC LLC ADD LINK CONT branch in smc llc event handler stores an incoming qentry into the local LLC flow without...

PT-2026-79614

In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipc node link down tipc node link down caches the link pointer before taking n-lock: struct tipc link l = le-link; / unlocked / if !l return; tipc node write lockn; if !tipc link is...

Linux Distros Unpatched Vulnerability : CVE-2026-43971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in...

CVE-2026-69234

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with...

CVE-2026-69234 reflected cross site scripting vulnerability in Esri Portal for ArcGIS

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Users working with...

CVE-2026-69234

Esri Portal for ArcGIS versions 11.5 and prior contain a reflected cross-site scripting (XSS) vulnerability. A remote, unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. The CVSS 3.1 score is 6.1 (Medium) with...

CVE-2026-63466

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Vulnerability Details File: src/lib/addons/feature-event-formatter-md.ts Line: 355 in v8.0.1; format method Root Cause FeatureEventFormatterMd.format does: ts Mustache.escape = text = text; const text = Mustache.renderaction, context; mustache pinned ^4.2.0, confirmed installed 4.2.0 keeps escape...

GHSA-W4MQ-XH27-6XPX Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Vulnerability Details File: src/lib/addons/feature-event-formatter-md.ts Line: 355 in v8.0.1; format method Root Cause FeatureEventFormatterMd.format does: ts Mustache.escape = text = text; const text = Mustache.renderaction, context; mustache pinned ^4.2.0, confirmed installed 4.2.0 keeps escape...

NPM: Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

NPM: Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

EUVD-2026-64042

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-63466 Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-63466

Unleash (open-source feature management platform) is affected by a global Mustache.escape override in versions prior to 8.0.3 . The FeatureEventFormatterMd.format function in feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering templates. Because this ass...

CVE-2026-63466 Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-17252

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

CVE-2026-17252 Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management Interface

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

EUVD-2026-64008

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

CVE-2026-17252

A stack-based out-of-bounds write vulnerability exists in the login request handling of the administrative web interface on TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the flaw by sending a specially crafted malformed HTTP request, causing the web service proces...