otanalytics (>=0.5.4, <=0.6.14), synth-mapping-helper (1.5.10) potentially affected by CVE-2026-39844 via nicegui (2.11.0)

nicegui PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - otanalytics =0.5.4, =0.6.14 - synth-mapping-helper 1.5.10 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

synth-mapping-helper (1.5.9) potentially affected by CVE-2026-39844 via nicegui (2.8.1)

nicegui PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.9 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

synth-mapping-helper (>=1.5.3, <=1.5.7) potentially affected by CVE-2026-39844 via nicegui (2.5.0)

nicegui PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.3, =1.5.7 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

synth-mapping-helper (>=1.5.1, <=1.5.2) potentially affected by CVE-2026-39844 via nicegui (2.3.0)

nicegui PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.1, =1.5.2 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

synth-mapping-helper (>=1.4.8, <=1.5.0) potentially affected by CVE-2026-39844 via nicegui (1.4.36)

nicegui PYPI version 1.4.36 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.4.8, =1.5.0 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

synth-mapping-helper (1.4.7) potentially affected by CVE-2026-39844 via nicegui (1.4.30)

nicegui PYPI version 1.4.30 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.4.7 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

CVE-2026-39409

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.12, ipRestriction does not canonicalize IPv4-mapped IPv6 client addresses e.g. ::ffff:127.0.0.1 before applying IPv4 allow or deny rules. In environments such as Node.js dual-stack, this can cause...

CVE-2026-39575

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through = 5.5.0...

CVE-2026-39575

CVE-2026-39575 affects the WordPress plugin “Custom Query Blocks” (Ronald Huereca) for the post-type-archive-mapping feature, with DOM-based XSS caused by improper neutralization of input during web page generation. Affected versions are

PT-2026-31162

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through = 5.5.0...

CVE-2026-39575: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronald Huereca Custom Query Blocks post-type-archive-mapping allows DOM-Based XSS.This issue affects Custom Query Blocks: from n/a through = 5.5.0...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006755)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006755 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the parameters of bo mapping operations more clearly Verify the parameters o...

xibocms 3.3.4 - RCE

Exploit Title: XiboCMS 3.3.4- Remote Code Execution Google Dork: N/A Date: 2025-11-18 Exploit Author: complexusprada Vendor Homepage: https://xibo.org.uk/ Software Link: https://github.com/xibosignage/xibo-cms Version: 1.8.0 - 2.3.16, 3.0.0 - 3.3.4 Tested on: Ubuntu Linux Docker, Xibo CMS 3.3.4...

CVE-2026-35409

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.0, a Server-Side Request Forgery SSRF protection bypass has been identified and fixed in Directus. The IP address validation mechanism used to block requests to local and private networks could be...

User Impersonation

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to User Impersonation via the ASGIRequest objects. An attacker can impersonate users or manipulate request headers by exploiting the...

EUVD-2026-19686

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants with hyphens or with underscores to a single version with underscores. Earlier, unsupported Django...

CVE-2026-3902

The Django web application framework is vulnerable to a remote header spoofing attack due to an issue in the ASGIRequest component. The root cause is an ambiguous mapping where two header variants (using hyphens or underscores) are mapped to a single version using underscores. This allows an atta...

CVE-2026-3902

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants with hyphens or with underscores to a single version with underscores. Earlier, unsupported Django...

CVE-2026-3902

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. "ASGIRequest" allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants with hyphens or with underscores to a single version with underscores. Earlier, unsupported Djan...

CVE-2026-23401

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component. A local attacker with privileges on the host system could exploit a vulnerability in how KVM handles shadow page table entries SPTEs during memory-mapped I/O MMIO operations. By manipulating guest page table entrie...