CVE-2026-15337 Potential denial-of-service vulnerability in check_for_language()

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

CVE-2026-15337

Technical details are not publicly available in the provided documents. Monitor for updates.

CLSA-2026-1782954034 TuxCare security update for set-value (2 CVEs)

TuxCare rebuilt set-value to address 2 CVEs. Fixed in 2.0.0-tuxcare.1...

CLSA-2026-1775003201 TuxCare security update for lodash.set (1 CVE)

TuxCare rebuilt lodash.set to address 1 CVE. Fixed in 4.3.2-tuxcare.1...

CVE-2026-16068 Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learning

Backdoor attacks in multimodal contrastive learning MCL have garnered growing attention in recent years, as many downstream tasks critically depend on pre-trained MCL models. Existing detection-based defenses predominantly rely on the CLIPScore metric, under the assumption that poisoned pairs...

PT-2026-75236

TuxCare rebuilt set-value to address 2 CVEs. Fixed in 2.0.0-tuxcare.1...

CVE-2025-29296

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...

Important: runfinch-finch

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

PT-2026-69036

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.1.16.0 Description A use-after-scope crash and denial of service can occur when processing a crafted ZIP-compressed TIFF file with TIFF multithreading enabled. The issue arises in the TIFFInput::read native...

CVE-2025-29296

Several H3C network devices, including the Magic BE18000 V200R007 , NX400 V100R015 , Magic NX30 Pro V100R0011 , Magic R3010 V100R009 , Magic NX15 V100R017 , Magic R1510 V100R016 , NE36 Pro V100R002 , and MC102G HM1A0V200R010 , are vulnerable to multiple command injection flaws in the /api/esps re...

CVE-2026-18685

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function setupgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly...

CVE-2026-18685

CVE-2026-18685 affects GL.iNet GL-MT3000 devices up to firmware 4.4.5, specifically the function set_upgrade in /cgi-bin/glc of the component modem.so. The issue enables remote command injection due to the underlying vulnerability; attack vector is network with no authentication and no user inter...

NPM: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

NPM: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields vulnerability discovered by ? in WordPress Npm undici versions 6.28.0...

EUVD-2026-50409

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives...

CVE-2026-18616 GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

CVE-2026-18616 GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

CVE-2026-18613

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-18613

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...

CVE-2026-18613 GL-iNet GL-MT3000 plugins.so Native Plugin glc plugins.set_config injection

A vulnerability has been found in GL-iNet GL-MT3000 up to 4.4.5. This issue affects the function plugins.setconfig of the file /cgi-bin/glc of the component plugins.so Native Plugin. Such manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed to the...