CVE-2026-102173 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::imageelement, which concatenates a...

CVE-2026-102173

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.3.1 . The root cause is insufficient escaping in the ExceptionalElements::image_element() function, which directly concaten...

CVE-2026-102173 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::imageelement, which concatenates a...

CVE-2019-8997

CVE-2019-8997 BlackBerry AtHoc 早于 7.6 HF-567 版本的管理系统（控制台）中存在一个 XML 外部实体注入（XXE）漏洞，攻击者可能通过在现有字段中输入恶意构造的 XML，从而读取应用服务器上的任意本地文件或向网络发出请求。 报告人 Nolan B. Kennedy nxkennedy 安全公告 http://support.blackberry.com/kb/articleDetail?articleNumber=000047227 https://nvd.nist.gov/vuln/detail/CVE-2019-8997 博文...

CVE-2026-44011-craftcms-auth-rce

CVE-2026-44011 PoC de RCE autenticado en Craft CMS Solo para pruebas autorizadas. El aviso de Craft CMS indica =4.0.0, =5.0.0, ' -c '' Argumentos requeridos: -b, --base-url: URL de Craft, incluyendo http:// o https://. -u, --username: Nombre de usuario del panel de control. -p, --password:...

CVE-2026-106295

Incorrect authorization in Unbounded Element in Google Chrome prior to...

PT-2026-107644

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers reads ws.Drawing.RID after seeing a...

PT-2026-107392

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in ExceptionalElements::image element, which concatenates a...

PT-2026-107459

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6...

CVE-2026-106186

Uncontrolled search path element in CredentialProvider in Google Chrom...

PT-2026-107460

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6...

Linux Distros Unpatched Vulnerability : CVE-2026-106295

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof...

Linux Distros Unpatched Vulnerability : CVE-2026-106186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute...

PT-2026-107662

Name of the Vulnerable Software and Affected Versions Excelize versions 2.1.0 through 2.11.0 Description An issue exists where the library fails to validate the Min and Max attributes of column ranges loaded from a file against the worksheet column limit. When a crafted worksheet contains an...

Unbreakable Enterprise kernel security update

5.15.0-325.220.5 - octeontx2-pf: fix SQB pointer leak on init failure Dawei Feng Orabug: 39951718 - batman-adv: Remove stale reason member from batadvtpvars Vijayendra Suman Orabug: 39966037 - Revert 'octeontx2-pf: Fix leak of SQ timestamp buffer on teardown' Vijayendra Suman Orabug: 39967930 -...

Unbreakable Enterprise kernel security update

6.12.0-207.111.5.1 - selftests/mm/khugepaged: include kselftest.h in khugepaged Sherry Yang Orabug: 40099804 6.12.0-207.111.5 - Rename ONOS kernel flavor to OSP for OL9 and OL10 Vijay Kumar Orabug: 40055216 - tcp: Remove hashinfo test for inet6?lookuprunsklookup. Kuniyuki Iwashima Orabug: 4005230...

CVE-2026-106186

An uncontrolled search path element flaw was found in the CredentialProvider component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522557469 https://code.google.com/p/chromium/issues/detail?id=106186...

Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

Root Cause File: internal/corazawaf/transaction.go, lines 770–808 since commit 2fd87b89, PR 812, 2023-06-14 go func tx Transaction AddGetRequestArgumentkey string, value string if tx.checkArgumentLimittx.variables.argsGet tx.debugLogger.Warn.Msg"skipping get request argument, over limit" return...

GHSA-6R3Q-MJV7-XR8M Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

Root Cause File: internal/corazawaf/transaction.go, lines 770–808 since commit 2fd87b89, PR 812, 2023-06-14 go func tx Transaction AddGetRequestArgumentkey string, value string if tx.checkArgumentLimittx.variables.argsGet tx.debugLogger.Warn.Msg"skipping get request argument, over limit" return...

DEBIAN-CVE-2026-106444

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.precompile uses quotedString in lib/handlebars/compiler/code-gen.js to emit static template text into generated JavaScript without escaping sequences that terminate an enclosing HTML...