Astra Linux – Vulnerability in Squid

Squid is a caching proxy for the Web. Due to a bug related to expired pointer references, Squid versions prior to 6.6 were vulnerable to a Denial of Service attack targeting error responses from the Cache Manager. This vulnerability allowed a trusted client to cause a Denial of Service attack by...

WordPress Essential Addons for Elementor plugin < 6.6.10 - Lite < 6.6.10 - Contributor+ Stored XSS vulnerability

WordPress Essential Addons for Elementor plugin 6.6.10 - Lite 6.6.10 - Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Essential Addons for Elementor versions 6.6.10...

CVE-2026-64730

The issue was addressed with improved UI. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Visiting a website that frames malicious content may lead to UI spoofing...

CVE-2026-43816

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination...

CVE-2026-64741

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read a persistent device identifier...

CVE-2026-43744

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing an audio stream in a malicious...

CVE-2026-43800

An information disclosure vulnerability exists in various Apple operating systems where an application may be able to access sensitive user data . This issue was addressed by removing the vulnerable code. The vulnerability is fixed in iOS 18.7.10 , iPadOS 18.7.10 , iOS 26.6 , iPadOS 26.6 , macOS ...

EUVD-2026-49504

An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to access sensitive user data...

CVE-2026-15156

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This mak...

PT-2026-61824

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/action/sync; the regular integration endpoint POST...

Vulnerability concealment in Fortinet FortiAuthenticator

Fortinet has identified a vulnerability in FortiAuthenticator. This vulnerability involves an out-of-bounds read in FortiAuthenticator versions 6.5, 6.6.0, and up to 6.6.2. An external, unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, thereby allowing...

CVE-2026-53184 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53184 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53077 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53077 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53149 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53149 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53013 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53013 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-46158 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-46158 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-52927 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-52927 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-49229

Affected software: Actual, a local-first personal finance app. Vulnerability summary: In OpenID multi-user mode prior to 26.6.0, disabling a user blocks future OpenID logins but does not revoke existing session tokens. The shared session validation path accepts any non-expired token, allowing a d...

PYSEC-2026-1829 pypdf has possible long runtimes for missing /Root object with large /Size values

Impact An attacker who exploits this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. Patches This...