6 Best VPN Services (2026), Tested and Reviewed

Every VPN says it’s the best, but only some of them are telling the truth...

CVE-2025-9878: Improper Neutralization of Input During Web Page Generation

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied...

CVE-2025-10005: Authorization Bypass Through User-Controlled Key

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.20 via the ppwfreesetpassword AJAX action due to missing validation on a user controlled key. This makes it...

rclone: Local Encoding Path Traversal

Summary The local backend relies on its configurable filename encoder to prevent remote filename data from becoming operating-system path syntax. If a local destination uses an encoding that omits Dot, such as Slash, None, or Raw, a remote object's standard-encoded ．． component is decoded into an...

Inside the Advisory Database and what happens when vulnerability volume breaks records

In May 2026, the GitHub Advisory Database published 1,560 reviewed advisories --more than five times our typical monthly output and the highest in its history. And it still wasn't enough to keep up. Over the past few months, the vulnerability ecosystem has shifted in a fundamental way. Input acro...

EUVD-2026-38407

vLLM is an inference and serving engine for large language models LLMs. Prior to 0.22.0, vLLM's revision pinning controls do not consistently apply to all artifacts loaded for a model. A deployment that supplies --revision or --code-revision can still load dynamic code, GGUF files, image...

glibc security update

2.28-251.0.3.25 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi Oracle history: June-9-2025 Cupertino Miranda - 2.28-251.0.3.22 - Forward port of Oracle patches Reviewed-by: David Faust April-14-2025 Cupertino Miranda - 2.28-251.0.3.16 - Forward port of Oracle patches Reviewed-by:...

GitHub Advisory Database by the numbers: Known security vulnerabilities and what you can do about them

The GitHub Advisory Database Advisory DB is a vital resource for developers, providing a comprehensive list of known security vulnerabilities and malware affecting open source packages. This post analyzes trends in the Advisory DB, highlighting the growth in reviewed advisories, ecosystem coverag...

glibc security update

2.28-251.0.3.22 - Forward port of Oracle patches Reviewed-by: David Faust Oracle history: April-14-2025 Cupertino Miranda - 2.28-251.0.3.16 - Forward port of Oracle patches Reviewed-by: Elena Zannoni March-26-2025 Cupertino Miranda - 2.28-251.0.3.14 - OraBug: 36625686 Add MTE support on string...

gcc security update

4.8.5-45.0.1 - Orabug: 37603707 ELSA-2025-1601 Moderate: gcc security update CVE-2020-11023 rebuild for CVE-2020-11023 - Reviewed-by: Jose E. Marchesi 4.8.5-44.0.5 - fix arm cross building inline issue. gcc48-cfns-fix-protos.patch - Reviewed-by: Jose E. Marchesi 4.8.5-44.0.3 - Orabug: 31505739...

glibc security update

2.34-100.0.1.2 - Forward-port Oracle patches for ol9-u4 Reviewed by: Jose E. Marchesi...

glibc security update

2.34-60.0.3 - CVE-2023-4911: tunables: Terminate immediately if end of input is reached Reviewed by: Jose E. Marchesi...

User Avatar - Reloaded < 1.2.2 - Contributor+ Stored XSS

Description The plugin does not properly sanitize and escape certain of its shortcodes attributes, which could allow relatively low-privileged users like contributors to conduct Stored XSS attacks. As a Contributor+ create a new post and add one of the following shortcode. avatar user="admin"...

cross-gcc security update

12.1.1-2.0.4 - CVE-2023-4039 mitigation. Orabug 35752028. - Reviewed-by: Jose E. Marchesi...

ol8addon security update

golang 1.17.13-1.0.1 - Update tarball to 1.17.12 - Add patches between Go 1.17.12 and Go 1.17.13 - Reviewed-by: David Faust 1.17.12-1 - Update Go to version 1.17.12 - Resolves: rhbz2109182 go-toolset 1.17.13-1 - Set version to correspond to the matching build golang version...

Researchers hack SpaceX Starlink satellite signal for GPS alternative

By Deeba Ahmed A non-peer-reviewed paper published by The University of Texas at Austin provides a complete characterization of Starlink’s signals claiming to have taken the first step toward creating a brand-new global navigation technology. This is a post from HackRead.com Read the original pos...

golang security update

1.18.5-1.0.1 - golang-1.18.5 package initial release - Reviewed-by: Jose E. Marchesi 1.18.4-1.0.1 - golang-1.18.4 package initial release - Reviewed-by: Jose E. Marchesi 1.18.3-1.0.1 - golang-1.18.3-1 package initial release - Add patch to skip ed25519vectors test that fetches a file from the...

golang security update

1.17.13-1.0.1 - golang-1.17.13 release - Update tarball and version number in specfile - Reviewed-by: Jose E. Marchesi 1.17.12-1.0.1 - golang-1.17.12-1 release - Update tarball and version number in specfile - Reviewed-by: Indu Bhagat 1.17.11-1.0.1 - golang-1.17.11-1 package initial release - Add...

binutils security update

2.27-44.base.0.3.1 - Forward-port patches to 2.27-44.base.1 - Reviewed-by: Jose E. Marchesi 2.27-44.base.0.2.1 - Forward-port patches to 2.27-44.base.1 - Reviewed-by: Jose E. Marchesi 2.27-44.base.1 - Add ability to control the display of unicode characters. 2009168...

glibc security and bug fix update

2.17-322.0.2 - merge RH el7 u9 errata patches with Oracle patches Review-exception: Simple merge - merge RH el7 u9 patches with Oracle patches Review-exception: Simple merge - Four patches to match 3rd patch bundle from Marvell - modify MIPS values in elf/elf.h - add sysdeps/aarch64/sys/ifunc.h -...