CVE-2026-53530

RaTeX (a KaTeX-compatible math rendering engine in Rust) is vulnerable to a denial of service in ratex-parser prior to version 0.1.11 . The parser slices the \verb argument using byte indices (arg[1..arg.len() - 1] at parser.rs:910); when the delimiter is a multibyte UTF-8 character (e.g. é), the...

EUVD-2026-64179

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint ratexparser::parse&str panics on the 9-byte input \verbéxé i.e. \verb followed by the non-ASCII delimiter é. When handling a \verb command, the parser slices the verbatim...

GHSA-XHJ3-7XW9-VR34 kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

Summary An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array a normal, documented pattern,...

kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

Summary An uncontrolled resource consumption vulnerability in openapi3filter lets any unauthenticated client force multi-gigabyte heap allocation with a single, tiny HTTP request. When a spec declares a deepObject-style query parameter whose schema contains an array a normal, documented pattern,...

CVE-2026-18299

A flaw was found in GStreamer. This use-after-free vulnerability in the rtpsbcdepay element, specifically during the processing of Real-time Transport Protocol RTP payload elements, allows a remote attacker to execute arbitrary code. The issue arises from a lack of validation for an object's...

CVE-2026-55850

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence AI-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary,...

EUVD-2026-64046

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

CVE-2026-55850

Element Web (a Matrix web client) prior to 1.12.22 is vulnerable to HTML injection via the EmbeddedPage component (apps/web/src/components/structures/EmbeddedPage.tsx). The component renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedH...

CVE-2026-55850 Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element Web is a Matrix web client built using the Matrix React SDK. Prior to 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious...

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 10, 2026 to August 16, 2026)

Last week, there were 260 vulnerabilities disclosed in 200 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 142 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Exploit for CVE-2026-76565

Reflected XSS via pricefrom / priceto Filter Parameters in P...

Malicious code in kelly-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

MAL-2026-14354 Malicious code in kelly-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

100,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Pods WordPress Plugin

On August 10th, 2026, we received a submission for an Unauthenticated Privilege Escalation vulnerability in Pods, a WordPress plugin with more than 100,000 active installations. This vulnerability allows unauthenticated attackers to escalate their privileges to administrator and perform various...

CVE-2026-76611

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo 4.1.66...

EUVD-2026-63939

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo 4.1.66...

CVE-2026-76611

Zoo is a Joomla extension developed by yootheme.com . The Gallery element in Zoo versions prior to 4.1.66 is vulnerable to unauthenticated arbitrary directory listing , allowing a remote attacker over the network to list directory contents without any authentication or user interaction. The CVSS ...