PT-2026-60894

Name of the Vulnerable Software and Affected Versions plone.app.textfield versions prior to 2.0.2 plone.app.textfield versions prior to 3.0.2 plone.app.textfield versions prior to 4.0.1 Description A stored Cross-Site Scripting XSS issue affects RichText fields. The RichTextValue.output function...

The vulnerability of the console-based graphic editor ImageMagick arises from a lack of mechanisms for encoding or shielding output data, allowing attackers to execute arbitrary code.

The vulnerability of the console-based graphic editor ImageMagick is related to the lack of mechanisms for encoding or shielding the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2025-51677

The CVE-2025-51677 issue affects the openRISC OR1200 CPU, where an output mismatch between the RTL and the netlist on the or1200 cpu output port can cause unexpected behavior. The vulnerability is tied to openRISC OR1200 commit 83ac6b. Impact is described as High for integrity and availability, w...

Security Update for Microsoft Visual Studio Code (July 2026)

The version of Microsoft Visual Studio Code installed on the remote Windows host is prior to 1.128.1. It is, therefore, affected by multiple vulnerabilities: - Improper neutralization of special elements in output used by a downstream component 'injection' in GitHub Copilot and Visual Studio allo...

CVE-2025-51677

An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between the RTL and the netlist of the or1200 cpu output port can lead to unexpected behavior...

GHSA-VWJC-V7X7-CM6G ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabaseUPDATESECURITY gate on the polyglot engine PolyglotQueryEngine.java:112-114,126,176,199, but only there. The SQL route to JavaScript never touches it: DefineFunctionStatement.executeSimple DefineFunctionStatement.java:37-100,...

CVE-2026-60063

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability...

CVE-2026-60140 AutomationDirect Productivity Suite Out-of-bounds Read

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable...

CVE-2026-61389

Technical details about CVE-2026-61389 are not publicly provided in the supplied documents; no affected product versions, root cause, or remediation details are present beyond the basic description. Monitor for updates.

CVE-2026-61389 AutomationDirect Productivity Suite Out-of-bounds Write

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability...

EUVD-2026-45024

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability...

CVE-2026-54728 bunkerweb: Improper Input Validation and Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in BunkerWeb

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a...

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant can create EnvoyExtensionPolicy baseline - Attacker hosts a gzip-bomb at a reachable URL - sha256 unset optional field; check is post-decompression anyway - No operator...

SUSE-SU-2026:3088-1 Security update for tomcat

This update for tomcat fixes the following issues Update to Tomcat 9.0.119. Security issues fixed: - CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. - CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caus...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via unvalidated workspace outputPath handling in WorkspaceConfigurationStorageService and BaseApiConsumerConfiguration during kiota client generate and kiota plugin generate. An attacker can make Kiota write generate...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the OpenApiKiotaExtension handling in LanguageInformation and kiota info output. An attacker can make a developer run attacker-controlled shell commands by supplying an OpenAPI document whose x-ms-kiota-info...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the LanguageInformation handling in Kiota.Builder.Models.LanguageInformation and GenerationConfiguration when it reads x-ms-kiota-info clientClassName and clientNamespaceName values. An attacker can overwrite...

CVE-2026-59866

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when kiota...

CVE-2026-59863

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious...

CVE-2026-59863 Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious...