CVE-2026-53610 GLPI: Reflected XSS in dashboards

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. Th...

Chromium CVE-2026-95274: Improper output encoding in DevTools

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-98139 ntfs: only count successfully cleared runs when freeing clusters

In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...

CVE-2026-95864 Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cssfonts' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

EUVD-2026-86600

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...

Exploit for CVE-2026-61732

CVE-2026-61732 — Decepticon ChatML role-boundary forgery lab...

CVE-2026-96039 BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Linux Distros Unpatched Vulnerability : CVE-2026-98139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock...

CVE-2026-53610: Improper Neutralization of Input During Web Page Generation

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. Th...

PT-2026-99069

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description An attacker can craft a URL for a dashboard that reflects attacker-controlled markup due to insufficient output encoding. A user who opens this crafted URL triggers reflected cross-site scripting...

CVE-2026-98139: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...

pgAdmin 4 Output Encoding

The vulnerability of the pgAdmin 4 database management tool is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

pgAdmin 4 Output Encoding

The vulnerability of the pgAdmin 4 database management tool is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

EUVD-2026-66225

Trestle is vulnerable to arbitrary file write via path traversal in author generate commands Incomplete fix of CVE-2026-46345...

Directory Traversal

Overview compliance-trestle is a Tools to manage & autogenerate python objects representing the OSCAL layers/models Affected versions of this package are vulnerable to Directory Traversal via the --output argument in the author catalog, author prof, author ssp, create, and replicate commands, whi...

CVE-2026-61732

Versions prior to 1.1.17 of Decepticon , an autonomous hacking agent, are vulnerable to a role-boundary forgery because they fail to neutralize ChatML special-token literals when wrapping web crawl results into LLM messages. When using the BYOK deployment model with common providers (such as vLLM...

CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

CVE-2026-56744

The @bsv/wallet-toolbox , @bsv/wallet-toolbox-client , and @bsv/wallet-toolbox-mobile packages contain a vulnerability where transactions created via a remote StorageClient do not verify that output locking scripts from the provider match the caller's requested outputs. A compromised provider cou...

CVE-2026-56744

"@bsv/wallet-toolbox" provides BRC-100 wallet signing and storage components, while "@bsv/wallet-toolbox-client" and "@bsv/wallet-toolbox-mobile" provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes...