CVE-2026-64823

CVE-2026-64823 affects Home Assistant Core prior to 2026.5.4 via the Shelly integration’s async_get_media_image(), where a data: URI with text/html can bypass the image-only allowlist. The vulnerability enables an attacker controlling a Shelly device’s thumb field to cause the media proxy endpoin...

EUVD-2026-46267

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex accepts arbitrary strings as submission indexes without numeric validation, and adminformelement...

CVE-2026-65048 Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex accepts arbitrary strings as submission indexes without numeric validation, and adminformelement...

SUSE CVE-2026-9323

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

SUSE CVE-2026-55626

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this...

SUSE CVE-2026-63918

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcountincnotzero in l2tpsessiongetbyifname A reader in l2tpsessiongetbyifname can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcountinc, but every other...

SUSE CVE-2026-64016

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...

SUSE CVE-2026-64119

In the Linux kernel, the following vulnerability has been resolved: l2tp: use listdelrcu in l2tpsessionunhash An unprivileged local user can pin a host CPU indefinitely in l2tpsessiongetbyifname by issuing L2TPCMDSESSIONGET on L2TPATTRIFNAME concurrently with L2TPCMDSESSIONCREATE and...

SUSE CVE-2026-64136

In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tccount increment in smb2findsmbsesstconunlocked Commit 96c4af418586 "cifs: Fix locking usage for tcon fields" refactored cifs code to change cifstcpseslock for tclock around tccount changes. There was missin...

SUSE CVE-2026-64141

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compareguidkey sessionfdcheck walks the per-inode moplist during durable-handle session teardown and sets op-conn = NULL for every opinfo whose conn matched the closing session's connection...

CVE-2026-64628

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

CVE-2026-64628

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-web-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Vulnerability Details CVEID:CVE-2026-41839 DESCRIPTION: A WebFlux application with a compromised subdomain for example, compromised via...

EUVD-2026-46156

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

CVE-2026-13439

The CVE-2026-13439 entry affects the WordPress plugin Easy Form Builder by WhiteStudio up to version 4.0.11 , where the password-recovery flow relies on a publicly visible session identifier ('sid') as the reset token stored in wp_emsfb_temp_links, combined with a publicly accessible nonce refres...

CVE-2026-53383

A flaw was found in the Linux kernel's ksmbd component. A remote attacker can trigger a NULL pointer dereference by sending a specially crafted compound SMB2 request. This occurs because the session validation logic for non-first operations in a compound request does not properly check the sessio...

PT-2026-61973

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains a stored cross-site scripting XSS flaw. This issue allows an authenticated attacker to inject malicious scripts that are stored on the server, which can...

📄 WordPress MainWP Child 5.3.3 Unauthenticated Administrator Session Takeover

WordPress MainWP Child plugin version 5.3.3 contains an unauthenticated administrator session takeover vulnerability through Rogue Site Registration. A remote attacker can obtain an authenticated administrator session and take control of the affected site. This proof of concept exploit demonstrat...

Guzzle: Host-only cookie scope is not preserved

Impact In affected versions, CookieJar does not preserve whether a response cookie was set without a Domain attribute or with an empty one. A cookie without Domain is host-only and must be returned only to the exact host that set it. Under current cookie processing rules, an empty Domain value is...

Incorrectly Specified Destination in a Communication Channel

Overview Affected versions of this package are vulnerable to Incorrectly Specified Destination in a Communication Channel via improper handling of host-only cookies in the CookieJar process. An attacker can obtain sensitive information such as session identifiers or authorization tokens by...