RiteCMS 3.0.0 - Cross-site Scripting

RiteCMS v3.0.0 contains a reflected XSS caused by unsanitized input in the mainmenu/editsection component, letting attackers execute arbitrary scripts in the context of the victim's browser. id: CVE-2024-28623 info: name: RiteCMS 3.0.0 - Cross-site Scripting author: 0xAkoko severity: medium...

EUVD-2026-60548

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...

CVE-2026-42164

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...

CVE-2026-42164

Mahara (e-portfolio platform) versions before 25.04.5 and 26.04.0 have a flaw in the Text block/section functionality: a crafted call can recall backed-up content from another user's Text section. This enables unauthorized access to confidential data with integrity and availability impacts. CVSS ...

CVE-2026-18653 WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter

The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...

CVE-2026-74451

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

CVE-2026-74451

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

CVE-2026-74451 drm/panthor: validate firmware interface structure sizes

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

EUVD-2026-59644

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate firmware interface structure sizes ifacefwtocpuaddr only checks that the firmware-provided MCU virtual address points inside the shared section. The returned pointer is later used as a full firmware interfac...

CVE-2026-74273

CVE-2026-74273 affects the Linux kernel’s cxl/region logic. The fix expands the range lock and renames it to a new lock called regions_lock to disable region deletion during two critical windows: between construct_region() and attach_target(), and between device_add() and registering the remove a...

Malicious code in async-critical-section (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 933cc6900114e5aef5a4b89e0c20c0242cf368b5322cf260ae395c75cc97552f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13998 Malicious code in async-critical-section (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 933cc6900114e5aef5a4b89e0c20c0242cf368b5322cf260ae395c75cc97552f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits

A group of big tech firms is fighting to stop roughly 3,000 youth safety lawsuits from moving forward, and they just lost a critical procedural battle in court. The lawsuits, brought by attorneys general and families, allege that Meta, Google, ByteDance's TikTok, and Snap knew their products were...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: EFI/CPER: Do not exceed the ARM processor CPER record buffer. There is a logic within GHES/CPER that detects whether the sectionlength is too small, but it does not detect whether it is too large. Currently, if the firmware...

Linux Distros Unpatched Vulnerability : CVE-2026-68286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dropmonitor: perform u64stats updates under IRQ-disabled section In netdmpackettracekfreeskbhit and netdmhwtrappacketprobe, u64statsupdatebegin / u64statsinc /...

CVE-2026-10709

The CVE-2026-10709 entry concerns Autodesk FBX SDK: a crafted FBX file can trigger a stack-based buffer overflow in fbxsdk::FbxIO::BinaryReadSectionHeader. The vulnerability allows arbitrary code execution in the hosting process. Documents identify the affected component as the Autodesk FBX SDK’s...

SUSE CVE-2026-67326

GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...

CVE-2026-67326

A flaw was found in GitPython. This vulnerability allows attackers to inject newline characters into the section parameter of the configwriter function, leading to the injection of arbitrary section headers into the .git/config file. By forging a core section with a malicious hooksPath, an attack...

CVE-2026-69097

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...

CVE-2026-69097 GitPython before 3.1.53 Config Injection via Submodule Names

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via...