CVE-2026-23401

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE When installing an emulated MMIO SPTE, do so after dropping/zapping the existing SPTE if it's shadow-present. While commit a54aa15c6bda3 was right about...

Joomla! CMS 跨站脚本漏洞

Joomla! CMS is a content management system developed under the open source Joomla! framework. Joomla! CMS has a cross-site scripting vulnerability, which stems from the lack of output escaping in article titles, potentially leading to cross-site scripting attacks...

Joomla! CMS 安全漏洞

Joomla! CMS is a content management system developed under the open source Joomla! framework. The Joomla! CMS has security vulnerabilities, which stem from the lack of output escaping mechanisms. This may lead to cross-site scripting vectors in multilingual integrated components...

PT-2026-29504

Name of the Vulnerable Software and Affected Versions versions affected versions not specified Description A lack of output escaping for article titles creates cross-site scripting XSS vectors in multiple areas. Recommendations At the moment, there is no information about a newer version that...

ROS-20260401-73-0001

A vulnerability in the HTML Style Checker module of RoundCube Webmail is related to incorrect encoding or escaping of output data. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

Medium: python

Issue Overview: The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update, |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.jsoutput lacked the output...

PT-2026-29503

Name of the Vulnerable Software and Affected Versions versions prior to 2.3 Description A lack of output escaping creates a cross-site scripting XSS vector within the multilingual associations component. Recommendations Update to version 2.3 or later...

The vulnerabilities of the functions mdio_busPhy_suspend() and mdio_bus Phy_resume() in the module drivers/net/phy/phy_device.c of the Linux operating system’s physical-layer PHY driver allow a attacker to cause a service failure.

The vulnerability of the functions mdiobusPhysuspend and mdiobus Phyresume in the drivers/net/phy/phydevice.c file of the Linux physical-layer network driver is related to improper termination or release of resources. Exploiting this vulnerability could allow a remote attacker to cause service...

PT-2026-29627

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.0.0 Description CI4MS fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields, including Company Name, Slogan, Company Phone, Compa...

PT-2026-29626

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.0.0 Description CI4MS, a CodeIgniter 4-based CMS, is susceptible to a stored Cross-site Scripting XSS issue within the System Settings – Social Media Management section. The application does not properly sanitize...

The vulnerability of the ASUS Business System Control Interface arises from the improper assignment of permissions for critical resources, allowing an intruder to gain unauthorized access to protected information.

The vulnerability of the ASUS Business System Control Interface is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by sending a specially crafted IOCTL request...

GHSA-5H2W-QMFP-GGP6 OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose`

Summary The chat.send path let authorized write-scoped callers persist /verbose session overrides even though the same stored session mutation is admin-only through sessions.patch. Impact A write-scoped gateway caller could persist verbose output for later runs and expose more reasoning or tool...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the chat.send process. An attacker can persist verbose output for future sessions and expose additional internal reasoning or tool output by leveraging...

Cross-site Scripting (XSS)

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Cross-site Scripting XSS in the jsonToFormElements process in admin/functions.php when user-controlled plugin configuration values are rendered in HTML forms witho...

AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel

Summary The AVideo admin panel renders plugin configuration values in HTML forms without applying htmlspecialchars or any other output encoding. The jsonToFormElements function in admin/functions.php directly interpolates user-controlled values into textarea contents, option elements, and input...

GHSA-V4H7-3X43-QQW4 AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel

Summary The AVideo admin panel renders plugin configuration values in HTML forms without applying htmlspecialchars or any other output encoding. The jsonToFormElements function in admin/functions.php directly interpolates user-controlled values into textarea contents, option elements, and input...

CVE-2026-34553

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate and output produced by CIccMBB::Describe via CLUT dumping. This issue has been patched in version 2.3.1....

CVE-2026-34553

CVE-2026-34553 concerns iccDEV: a defect in LUT dump/iteration logic before version 2.3.1.6 causes a DoS via ICcCLUT::Iterate() and CIccMBB::Describe() (through CLUT dumping). The issue is fixed in version 2.3.1.6. Affected component: iccDEV color management libraries/tools; root cause: flawed LU...

EUVD-2026-17718

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate and output produced by CIccMBB::Describe via CLUT dumping. This issue has been patched in version 2.3.1....

CVE-2026-34553

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a defect in LUT dump/iteration logic affecting CIccCLUT::Iterate and output produced by CIccMBB::Describe via CLUT dumping. This issue has been patched in version 2.3.1....