CVE-2026-4840

creationtimestamp| type| source ---|---|--- 2026-03-26 04:16:40+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4840 2026-03-26 05:18:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhwu3eol3e2t 2026-03-26 06:00:32+00:00| seen|...

CVE-2026-4329 Blackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header

The Blackhole for Bad Bots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent HTTP header in all versions up to and including 3.8. This is due to insufficient input sanitization and output escaping. The plugin uses sanitizetextfield when capturing bot data which...

CVE-2026-4335 ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title

The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment posttitle in all versions up to, and including, 6.4.3. This is due to insufficient output escaping in the getEditorPopup function and its corresponding media-popup.php template...

Malicious code in @validator-lut-sdk/v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cb4c0ee3137b51767f901297bd8743d7f23109b2897aec6b659a433c5c29a86 The package @validator-lut-sdk/v3 was found to contain malicious code. Source: ghsa-malware...

WordPress plugin DSGVO snippet for Leaflet Map and its Extensions 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

MyVideoConverter Pro 缓冲区错误漏洞

MyVideoConverter Pro is an open-source multi-format video conversion and processing tool developed by Ivideogo. Version 3.14 of MyVideoConverter Pro contains a buffer overflow vulnerability. This vulnerability stems from a local buffer overflow, which could allow attackers to cause the applicatio...

Timo 安全漏洞

Timo is a backend management system developed by auntvt. Version Timo 2.0.3 has a security vulnerability, which stems from a cross-site scripting vulnerability in the title field. Attackers can execute attacks through specially crafted links...

Fedora 45 : python3.13 (2026-e2f42121f3)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e2f42121f3 advisory. Automatic update for python3.13-3.13.12-2.fc45. Changelog Thu Mar 26 2026 Lumr Balhar - 3.13.12-2 - Security fix for CVE-2026-4519 rhbz2449729 Tenable has...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-006320)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006320 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, xfPointerNew frees cursorPixels on failure, then pointerfree calls...

Power AnyBurn 缓冲区错误漏洞

Power AnyBurn is a disc burning and image file processing tool developed by Power company. Version 4.3 of Power AnyBurn contains a buffer overflow vulnerability; this vulnerability stems from a buffer overflow in the Image file name field, which may lead to a denial-of-service attack...

Mattermost 安全漏洞

Mattermost is an open-source collaboration platform developed by the American company Mattermost. There is a security vulnerability in Mattermost, which stems from the lack of verification of the size of extracted files during decompression. This vulnerability could allow authenticated users to b...

WordPress plugin ShortPixel Image Optimizer 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-28644

Name of the Vulnerable Software and Affected Versions TL-WR850N version 3 Description The issue allows for the storage of administrative and Wi-Fi credentials in cleartext within a region of the device’s flash memory. The serial interface remains enabled and is protected by weak authentication. A...

PT-2026-28463

Name of the Vulnerable Software and Affected Versions EVerest versions prior to 2026.02.0 Description EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race condition leading to C++ undefined behavior UB, potentially resulting in memory corruption. This issue is...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-006318)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006318 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on serversupplied...

Fedora 45 : python3.12 (2026-15f71c015c)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-15f71c015c advisory. Automatic update for python3.12-3.12.13-2.fc45. Changelog Thu Mar 26 2026 Lumr Balhar - 3.12.13-2 - Security fix for CVE-2026-4519 rhbz2449728 Tenable has...

Mattermost 安全漏洞

Mattermost is an open-source collaboration platform developed by the American company Mattermost. Vulnerabilities exist in Mattermost versions 11.2.2 and earlier of the 11.2.x series, as well as versions 10.11.10 and earlier of the 10.11.x series, 11.4.0 and earlier of the 11.4.x series, and 11.3...

Fedora 45 : python3.6 (2026-3b4578d2f4)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3b4578d2f4 advisory. Automatic update for python3.6-3.6.15-55.fc45. Changelog Thu Mar 26 2026 Lumr Balhar - 3.6.15-55 - Security fix for CVE-2026-4519 rhbz2449733 Tenable has...

[slackware-security] bind

New bind packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/bind-9.18.47-i586-1slack15.0.txz: Upgraded. This update fixes a security issue: Fix unbounded NSEC3 iterations when validating referrals...

CVE-2026-34053

OpenEMR prior to version 8.0.0.3 has a missing authorization issue in the AJAX deletion endpoint at interface/forms/procedure_order/handle_deletions.php. This allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens for any patient. Versio...