DEBIAN-CVE-2026-78689

Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...

CVE-2026-59276

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-84805 Kimai 2.61.0 before 2.63.0 Authentication Bypass via API

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...

SUSE CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

The vulnerability of the checkExtractItems() method in the elFinderVolumeDriver.class.php file of the elFinder file manager allows a hacker to execute arbitrary code.

The vulnerability of the checkExtractItems method in the elFinderVolumeDriver.class.php file of the elFinder file manager allows for unlimited downloading of malicious files. Exploiting this vulnerability could enable a remote attacker to execute arbitrary code...

ROS-20260902-73-0011

The vulnerability of the HTTPConnection.urlopen method in the Python HTTP library, Urllib3, is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the rename method. An attacker can manipulate the prototype of the validated object by supplying specially crafted input keys that are interpreted as proto, leading to unintended property inheritance or behavior i...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop in the insertchild method of TreeObject, whose loop can fail to reach its exit condition. An attacker can hang the...

CVE-2026-84367 joi: object().rename() with a template target can set the validated object's prototype

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename implementation used by object.rename permits a schema that renames keys with a regular-expression source and a Joi.expression or Joi.x target that...

Updated perl-HTML-FormHandler packages fix a security vulnerability

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template...

MGASA-2026-0360 Updated perl-HTML-FormHandler packages fix a security vulnerability

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template...

EUVD-2026-68813

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

EUVD-2026-68768

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-78075 Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate 2.2.10 - Blog::removeimage checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path src belonged to that...

USN-8701-1 udisks2 vulnerability

It was discovered that UDisks did not correctly validate the caller identity when handling the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. A local attacker with an active console session could possibly use this issue to mount filesystems on behalf of arbitrary...

CVE-2026-77013 Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

CVE-2026-77013 Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

CVE-2026-77013

The WordPress plugin 爱采集数据采集和发布插件 (version

SUSE-SU-2026:23405-1 Security update for udisks2

This update for udisks2 fixes the following issue: - CVE-2026-7867: insufficient authorization checks on the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method can lead to local privilege escalation bsc1274430...

OPENSUSE-SU-2026:21704-1 Security update for udisks2

This update for udisks2 fixes the following issue: - CVE-2026-7867: insufficient authorization checks on the as-user option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method can lead to local privilege escalation bsc1274430...