CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

CVE-2026-96873 Reflected XSS in CirrusSearch debug explain output

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0...

CVE-2026-96873

The Mediawiki - CirrusSearch extension is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability due to the improper neutralization of input during web page generation. This issue specifically affects versions through 1.46.0 . While the CVSS 4.0 score indicates a Medium severity with ...

CVE-2026-96873 Reflected XSS in CirrusSearch debug explain output

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0...

PT-2026-104874

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pt event stop is called without PERF EF UPDATE flag, then perf aux output end is not called. A subsequent call to pt event start will call perf aux output begin again which...

PT-2026-98120

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the pinctrl mediatek paris component where the functions pinctrl gpio direction input and pinctrl gpio direction output acquire the pinctrl mutex. This requirement...

CVE-2026-77285

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

EUVD-2026-85518

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

DRUPAL-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

SUSE CVE-2026-95274

Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

MGASA-2026-0435 Updated cpio packages fix security vulnerabilities

Path Traversal in GNU cpio. CVE-2026-66484 Uncontrolled Memory Allocation in GNU cpio. CVE-2026-66485 Improper Output Encoding in GNU cpio. CVE-2026-66486...

Updated cpio packages fix security vulnerabilities

Path Traversal in GNU cpio. CVE-2026-66484 Uncontrolled Memory Allocation in GNU cpio. CVE-2026-66485 Improper Output Encoding in GNU cpio. CVE-2026-66486...

Linux Distros Unpatched Vulnerability : CVE-2026-95274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially...

HP Advance / Output Central Authentication Bypass / File Write

HP Advance and HP Output Central contain multiple vulnerabilities in the Drivve SecureScan and MFPsecure components. Remote unauthenticated attackers can exploit archive path traversal to write arbitrary files and achieve SYSTEM code execution, forge an HTTP header to bypass a local-only...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the exec rendering mode during certain error conditions, specifically when numretries is met. An attacker can obtain sensitive information by accessing stdout output that may contain...

CVE-2026-93989

A flaw was found in vLLM. A remote attacker can exploit a vulnerability by providing malformed input related to 'bad words' token processing. This can lead to out-of-bounds memory access, corrupting the internal data logits memory used for generating responses for other concurrent requests. As a...

SUSE CVE-2026-92520

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

CVE-2026-95682 MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View

MISP contains a stored cross-site scripting XSS vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "";. Because the value was placed inside a double-quoted...