Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: - For “ice”: validate the “queuequantas” parameters to prevent out-of-band OOB access. - Add prevention measures for “queuewraparound” in “quantum” configurations. - Ensure that “endqid” does not overflow by validating...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: rtw89: pci: validate sequence number of TX release report Hardware rarely reports an abnormal sequence number in the TX release report, which may lead to an out-of-bounds access to the wdring-pages array, causing a NULL...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: serial: liteuart: fix minor-number leak on probe errors Be sure to release the allocated minor number before returning on probe errors...

CVE-2026-6399

The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitizetextfield for output escaping in the Contact Number adcontactnumber field — a function that strips HTML tags but does not encode...

CVE-2026-6399 General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter

The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitizetextfield for output escaping in the Contact Number adcontactnumber field — a function that strips HTML tags but does not encode...

CVE-2026-6399

The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitizetextfield for output escaping in the Contact Number adcontactnumber field — a function that strips HTML tags but does not encode...

CVE-2026-6399 General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter

The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitizetextfield for output escaping in the Contact Number adcontactnumber field — a function that strips HTML tags but does not encode...

CVE-2026-6399

The CVE concerns the WordPress General Options plugin (up to version 1.1.0). Root cause: the code uses sanitize_text_field() for output escaping in the ad_contact_number field, which strips HTML but does not encode double quotes, so when echoed inside a double-quoted HTML attribute (value="..."),...

EUVD-2026-31040

The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0. This is due to the use of sanitizetextfield for output escaping in the Contact Number adcontactnumber field — a function that strips HTML tags but does not encode...

CVE-2026-6732

creationtimestamp| type| source ---|---|--- 2026-05-19 22:01:19+00:00| seen| https://bsky.app/profile/msw.bsky.social/post/3mmafccldts2j 2026-10-20 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-293-05...

CVE-2026-8951

creationtimestamp| type| source ---|---|--- 2026-05-19 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260520 2026-09-29 12:47:17+00:00| seen| https://infosec.exchange/users/cR0w/statuses/117354399908091855...

WS-2018-0100

Versions of concat-with-sourcemaps before 1.0.6 allocates uninitialized Buffers when a number is passed as a separator...

WS-2018-0074

bl before version 0.9.5 and version 1.0.1 are vulnerable to memory exposure. "bl.appendnumber" in the affected bl versions passes a number to buffer constructor, appending a chunk of uninitialized memory...

CLSA-2026-1779214181 vim: Fix of 4 CVEs

CVE-2022-3278: fix crash when using NUL in buffer that uses :source; don't get a next line when skipping over NL in evalnextnonblank eval.c, upstream patch 9.0.0552 - CVE-2023-48234: fix overflow when getting count for normal z command; break out of nvzet count loop when n LONGMAX/10 normal.c,...

CVE-2026-31378

creationtimestamp| type| source ---|---|--- 2026-05-19 17:02:23+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mm7umdaopw25...

CVE-2026-8827

creationtimestamp| type| source ---|---|--- 2026-05-19 12:53:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7gotmhok2k 2026-05-19 13:01:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7h5lczbw2e...

RHSA-2026:18045 Red Hat Security Advisory: jq security update

Bulletin has no description...

PT-2026-61341

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the TCP implementation where a stale per-CPU tcp tw isn variable can leak, enabling Initial Sequence Number ISN prediction. The issue occurs because the system assumes t...

CVE-2026-8785

A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file updateinfo.php of the component GET Parameter Handler. Executing a manipulation of the argument appointmentno can lead to sql injection. The...

CVE-2026-8785 projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection

A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file updateinfo.php of the component GET Parameter Handler. Executing a manipulation of the argument appointmentno can lead to sql injection. The...