CVE-2026-90896 Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

CVE-2026-54181 backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branche...

CVE-2026-54181 backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branche...

CVE-2026-54181

backpack/crud (a Laravel admin-panel CRUD package) contains a Stored XSS in the color column Blade template (color.blade.php). The escaped/unescaped rendering branches are inverted relative to all other column templates, so because $column['escaped'] defaults to true, stored values are rendered u...

EUVD-2026-77720

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branche...

CVE-2026-90788

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results i...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: delve security update

An update for delve is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-90788 magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results i...

CVE-2026-90788 magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results i...

EUVD-2026-77489

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results i...

CVE-2026-90788

A remote OS command injection vulnerability affects the Template Handler component of magicblack MacCMS10 (version 2026.1000.4055), specifically via manipulation of the file admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html. The attack requires high privileges (authe...

CVE-2026-90788 magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results i...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom: fix writes in read-only memory region This commit fixes a kernel error caused by a write operation in read-only memory: 9.068287 Unable to handle kernel write to read-only memory at virtual address ffff800009240ad8...

Astra Linux – Vulnerability in Golang-1.19

The html/template package does not properly handle HTML-like “” comment tokens, nor hashbang “!” comment tokens, in contexts. This may cause the template parser to incorrectly interpret the contents of contexts, resulting in actions being incorrectly escaped. This could be exploited to carry out ...

Astra Linux – Vulnerability in Velocity

An attacker who is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify Velocity templates running Apache...

Astra Linux – Vulnerability in underscore

The package underscore from 1.13.0-0 and before 1.13.0-2, as well as from 1.3.2 and before 1.12.1, are vulnerable to Arbitrary Code Injection via the template function, especially when a variable property is passed as an argument without proper sanitization...

Astra Linux – Vulnerability in Python-Django

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method used by "startapp --template" and "startproject --template" allows for directory traversal through archives that contain absolute or relative paths with dot segments...

Astra Linux – Vulnerability in Golang-1.19

Templates do not properly handle backticks as JavaScript string delimiters, and do not escape them as expected. Backticks have been used since ES6 for JavaScript template literals. If a template contains a Go template action within a JavaScript template literal, the contents of the action can be...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device, the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the ‘FLOWBLOCKUNBIND’...