CVE-2026-95817: Improper Neutralization of Input During Web Page Generation

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

ROS-20261002-73-0016

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261002-73-0020

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

RockyLinux 10 : ghostscript (RLSA-2026:74464)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:74464 advisory. ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter CVE-2026-39919 Tenable has extracted the preceding description block directly from t...

AlmaLinux 10 : ghostscript (ALSA-2026:74464)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:74464 advisory. ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter CVE-2026-39919 Tenable has extracted the preceding description block directly from th...

RHEL 9 : ghostscript (RHSA-2026:74457)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:74457 advisory. The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

DescriptionJupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output a...

PYSEC-2026-4032 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter

A flaw was found in Ghostscript. This heap-based buffer overflow vulnerability in the JPEG 2000 output adapter allows an attacker to cause memory corruption by supplying a specially crafted PDF file. The crafted PDF contains a JPEG 2000 image with mismatched component subsampling factors...

Moderate: Red Hat Security Advisory: ghostscript security update

An update for ghostscript is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

CVE-2026-78242

The Apache APISIX gateway (version 3.17.0 ) is susceptible to an insertion of sensitive information into log files vulnerability. Under specific response structures, the data-mask component may fail to redact request headers, resulting in unmasked header values being written to the log sink. To r...

CVE-2026-78242 Apache APISIX: data-mask may fail to redact request headers in logger output

Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0,...

CVE-2026-100184

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x attacker-chosen name matching the form's url. predefined value' parameter in all versions up to, and includin...

CVE-2026-89427

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 2.8.18 . The root cause is insufficient input sanitization and output escaping of the 's' Search Parameter . An unauthenticated attacker can inject...

EUVD-2026-90564

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-86610

The Download Manager WordPress plugin (versions before 3.3.71 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient sanitization and escaping of a package setting before it is rendered on a page; specifically, the sanitization logic fails to neutralize single quote...

CLEANSTART-2026-LU46498 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames

Security vulnerability affects the kube-state-metrics-fips package. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames...

PT-2026-105125

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num...

PT-2026-105813

Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...

Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fixes: ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter...