RHEL 10 : tomcat9 (RHSA-2026:67163)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67163 advisory. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages...

RHEL 8 : perl-YAML-Syck (RHSA-2026:67269)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67269 advisory. This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data...

Amazon Linux 2 : gimp (ALASGIMP-2026-020)

The version of gimp installed on the remote host is prior to 2.8.22-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GIMP-2026-020 advisory. GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

About the security content of macOS Sequoia 15.8

About the security content of macOS Sequoia 15.8 This document describes the security content of macOS Sequoia 15.8. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

About the security content of Xcode 27

About the security content of Xcode 27 This document describes the security content of Xcode 27. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recen...

About the security content of Safari 27

About the security content of Safari 27 This document describes the security content of Safari 27. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

ALSA-2026:67278 Moderate: perl:5.32 security update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 For more details about the security issues, including the impac...

ALSA-2026:67146 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:67156 Moderate: perl security update

Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 For more details about the security issues, including the impac...

MAL-2026-16202 Malicious code in webpackbootstrapscripts (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

RHEL 8 : perl:5.32 (RHSA-2026:67278)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67278 advisory. Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fixes: perl: Perl:...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock — CVE-2026-43499 PoC Qualcomm 4.19 kernel Local p...

CVE-2026-88793

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web...

CVE-2026-74933

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

CVE-2026-88793

The YouTube Embed WordPress plugin (versions 10.0–10.3 ) contains an unauthenticated stored XSS vulnerability in its youram_server AJAX action. The action performs no proper authorization check, relying solely on a nonce that is printed on every front-end page, and does not escape stored data bef...

CVE-2026-88793 YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web...

CVE-2026-88793 YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web...

EUVD-2026-77087

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web...

EUVD-2026-77084

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

CVE-2026-74933 GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...