CentOS Linux 6 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static (CENTOS6:CLSA-2026:1783432860)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1783432860 advisory. - A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malform...

CentOS Linux 8 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1783340758)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1783340758 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

AlmaLinux 9.2 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static / glib2-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1783341999)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783341999 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

AlmaLinux 9.6 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static / glib2-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783345900)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783345900 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

Rocky Linux 9.6 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static / glib2-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783345900)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783345900 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

CentOS Linux 7 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc (CENTOS7:CLSA-2026:1783440677)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1783440677 advisory. - A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malform...

CentOS Linux 8.5 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1783079861)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1783079861 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Summary parseCommaParts can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string. This is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made expand iterative and documented...

GHSA-6J4F-FJ2G-MC7P brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Summary parseCommaParts can exhaust the native stack and crash the process. There are two distinct ways to trigger it, both reachable from a single untrusted pattern string. This is the parsing-side counterpart to CVE-2026-14257 / GHSA-mh99-v99m-4gvg. That fix made expand iterative and documented...

SUSE CVE-2026-97933

In the Linux kernel, the following vulnerability has been resolved: tracing: Take tracearray reference when opening a tracer options file When a tracer option file is opened, it is passed a descriptor that points to an element on the tracearray's topts array. This element has information to find...

SUSE CVE-2026-101277

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkimprocessset of the file dkim.c of the component Tag Tokenizer. Performing a manipulation results in use of less trusted source. The attack may be initiated remotely. The...

SUSE CVE-2026-102276

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and use...

GHSA-8VVX-RFF5-P5RQ Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | nodemailer | | Repository | https://github.com/nodemailer/nodemailer | | Tested commit | 40d52215aac65b811d7e131bc916f68605efd9d2 | | Current tested version | 10.0.1 | | Confirmed vulnerable versions | 2.7.2, 3.0.0,...

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

Submission metadata | Field | Value | |---|---| | Ecosystem | npm | | Package | nodemailer | | Repository | https://github.com/nodemailer/nodemailer | | Tested commit | 40d52215aac65b811d7e131bc916f68605efd9d2 | | Current tested version | 10.0.1 | | Confirmed vulnerable versions | 2.7.2, 3.0.0,...

Quarterly WordPress Threat Intelligence Report – Q2 2026

As the leader in WordPress security, Wordfence provides unparalleled security coverage that fully encompasses protection, active monitoring, detection, and response all built around our threat intelligence, demonstrating a strong commitment to security. Our mission is to ensure comprehensive...

Cross-site Scripting (XSS)

Overview org.webjars.npm:serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a regex flaw in SCRIPTCLOSEREGEXP that allows a live tag to...

Cross-site Scripting (XSS)

Overview serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a regex flaw in SCRIPTCLOSEREGEXP that allows a live tag to survive...

CVE-2026-97711

A flaw was found in serialize-javascript. This vulnerability allows a remote attacker to conduct Cross-Site Scripting XSS attacks by supplying crafted function code containing unescaped script-closing tags. When the serialized function is embedded within an HTML script element, the unescaped tag...

Exploit for Code Injection in Craftcms Craft_Cms

CVE-2026-31857 - CraftCMS RCE exploit Python exploit for a RC...

DEBIAN-CVE-2026-97711

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because...