CVE-2026-27744

The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment renderi...

CVE-2026-27744 SPIP tickets < 4.3.3 Unauthenticated RCE

The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment renderi...

CVE-2026-27744 SPIP tickets < 4.3.3 Unauthenticated RCE

The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered by a template using unfiltered environment renderi...

CVE-2026-27744

The CVE-2026-27744 entry concerns the SPIP tickets plugin (versions prior to 4.3.3) with an unauthenticated remote code execution in the forum preview handling for public ticket pages. The vulnerability arises from appending untrusted request parameters into HTML that is later rendered by a templ...

CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting XSS vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an...

CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting XSS vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an...

CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting XSS vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. By bypassing the PDF preview logic, an...

CVE-2026-27822

RustFS before 1.0.0-alpha.83 is affected by a Stored XSS in the RustFS Console that bypasses PDF preview logic, allowing an attacker to steal admin credentials from localStorage and potentially takeover accounts and compromise the system. The issue is fixed in 1.0.0-alpha.83. No exploitation deta...

The vulnerability of the Visual Studio Code Markdown Preview Enhanced editor extension relates to improper code generation management, allowing an attacker to execute arbitrary code.

The vulnerability of the Visual Studio Code Markdown Preview Enhanced editor extension is related to improper handling of code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading a specially created file with the extension .Md...

PT-2026-21859

Name of the Vulnerable Software and Affected Versions SPIP tickets plugin versions prior to 4.3.3 Description The SPIP tickets plugin is affected by a remote code execution issue. An unauthenticated attacker can execute code on the web server through crafted content injection. The plugin appends...

SPIP tickets 安全漏洞

SPIP tickets are an extension plugin provided by the SPIP company. Versions of SPIP tickets prior to 4.3.3 contained a security vulnerability. This vulnerability stemmed from the forum preview processing, which added untrusted request parameters to HTML, potentially allowing remote code execution...

Important: Red Hat Security Advisory: RHTAS - Tech Preview Release Of the Policy Controller Operator

The Tech Preview release of the RHTAS Policy Controller Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.3 The RHTAS Policy Controller Operator can be used with OpenShift Container Platform 4.16, 4.17,...

February 24, 2026—KB5077241 (OS Builds 26200.7922 and 26100.7922) Preview

None None...

February 24, 2026—KB5077239 (OS Build 28000.1643) Preview

None None...

📄 Tactical RMM 1.3.1 Jinja2 Server-Side Template Injection

This Metasploit module targets a server-side template injection vulnerability in Tactical RMM's template preview endpoint. The implementation is clearly marked as experimental and manually ranked due to the inherently unstable exploitation technique it relies on. The module attempts to achieve...

MAL-2026-994 Malicious code in vl-ui-code-preview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5abf0716d5a814e3cd0ca1da245819d81f5238adb1911513d88b36825c7a99be The package vl-ui-code-preview was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in vl-ui-code-preview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5abf0716d5a814e3cd0ca1da245819d81f5238adb1911513d88b36825c7a99be The package vl-ui-code-preview was found to contain malicious code. Source: ossf-package-analysis...

Anthropic Launches Claude Code Security for AI-Powered Vulnerability Scanning

Artificial intelligence AI company Anthropic has begun to roll out a new security feature for Claude Code that can scan a user's software codebase for vulnerabilities and suggest patches. The capability, called Claude Code Security , is currently available in a limited research preview to...

CVE-2026-26993 Flare has XSS vulnerability in Raw File Preview

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Versions 1.7.0 and below allow users to upload files without proper content validation or sanitization. By embedding malicious JavaScript within an SVG or other active content formats such as HTML...

CVE-2026-26993 Flare has XSS vulnerability in Raw File Preview

Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Versions 1.7.0 and below allow users to upload files without proper content validation or sanitization. By embedding malicious JavaScript within an SVG or other active content formats such as HTML...