CVE-2026-17010

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

Security Bulletin: Multiple vulnerabilities fixed in IBM SevOne Network Performance Management for July 2026

Summary IBM SevOne Network Performance Management has addressed these security vulnerabilities in the Data Insight component with a Service Pack update. Vulnerability Details CVEID:CVE-2025-61723 DESCRIPTION: The processing time for parsing some invalid inputs scales non-linearly with respect to...

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

Summary The checkunsafeoptions guard can be bypassed on every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by combining a single-character kwarg with splitsinglecharoptions=False. The guard's candidate list omits the smuggled option, but transformkwarg...

GHSA-WVPP-8HX9-P66J GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

Summary The checkunsafeoptions guard can be bypassed on every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by combining a single-character kwarg with splitsinglecharoptions=False. The guard's candidate list omits the smuggled option, but transformkwarg...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability (CVE-2026-11714)

Summary IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability with the apiDiscovery-1.0 feature enabled. Vulnerability Details CVEID:CVE-2026-11714 DESCRIPTION: IBM WebSphere Application Server Liberty is affected by a server-side request forgery...

CVE-2026-65502

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...

CVE-2026-65502

CVE-2026-65502 applies to the WordPress Element Pack Elementor Addons plugin (versions

CVE-2026-65502 WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...

EUVD-2026-53961

Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...

CVE-2026-0673

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...

CVE-2026-0673

The CVE concerns the WordPress plugin Element Pack Addons for Elementor (affecting versions up to 8.3.15). It describes an email header injection vulnerability in the element_pack_contact_form AJAX action caused by insufficient sanitization of newline characters in user-provided input, allowing u...

CVE-2026-0673 Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...

EUVD-2026-53870

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...

EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2885)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...

The vulnerability of the spectre_bhb_loop_affected() function in the arch/arm64/kernel/proton-pack.c module, which is part of the ARM 64-bit kernel support for the Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the spectrebhbloopaffected function in the arch/arm64/kernel/proton-pack.c module, which is part of the ARM 64-bit kernel support for the Linux operating system, relates to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to cau...

EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2926)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...

Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation (CVE-2026-14446)

Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...

K000162741: Ruby on Rails Action Pack vulnerability CVE-2026-66066

Security Advisory Description Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation...

cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...

cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...