CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-57170

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560

CVE-2026-70560 affects Ultimate POS (Stock Management & Point of Sale). A stored XSS vulnerability allows low-privileged authenticated users to inject arbitrary HTML/script by submitting a malicious payload in the user first-name field during account creation. When such a user with a low-privileg...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-70560

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-19566

Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths. The encode method accepts any prefix length matching 0|1-90-9 and passes it to width2bits, which builds the mask as '1' x $width + 8, one character per bit. The inc...

UBUNTU-CVE-2026-68433

In the Linux kernel, the following vulnerability has been resolved: libceph: bound getversion reply decode to front len handlegetversionreply uses msg-frontalloclen as the decode boundary for MONGETVERSIONREPLY. That is the size of the reused reply buffer, not the number of bytes actually receive...

UBUNTU-CVE-2026-68441

In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TCACTREDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TCACTREDIRECT ex: via an eBPF program calling bpfredirect or an actbpf action, the redirect was silently lost i.e ...

UBUNTU-CVE-2026-68432

In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the sticky underlay netns vxlan-net. They differ once the device is created in or moved to a netns oth...

UBUNTU-CVE-2026-68436

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time most of it the two inlined dcscratchspace copies and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual siz...

PT-2026-71057

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

PT-2026-75906

This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks...

WordPress AI ANN PHP Object Injection Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress AI ANN suffers from a PHP object injection vulnerability. This vulnerability stems from improper handling of user input by the deserialization module, allowing attackers to inject...

Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097

This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks...

External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098

This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This...

PT-2026-76591

Name of the Vulnerable Software and Affected Versions Drupal Quick Tabs versions 0.0.0 through 4.3.1 Description An incorrect authorization issue allows forceful browsing. The module fails to correctly enforce access when rendering node and block tabs by treating neutral access results as grants...

kernel security update

4.18.0-553.153.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

CVE-2026-70560: Improper Neutralization of Input During Web Page Generation

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

PT-2026-71469

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description Type confusion in the "refint" module allows an object...