PYSEC-2026-3876 ONNX: TOCTOU arbitrary file read/write in save_external_dat

Summary The saveexternaldata method seems to include multiple issues introducing a local TOCTOU vulnerability, an arbitrary file read/write on any system. It potentially includes a path validation bypass on Windows systems. Regarding the TOCTOU, an attacker seems to be able to overwrite victim's...

CVE-2026-18351 Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter

The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementorfileupload function. This is due to insufficient file type validation in the isfiletypevalid function, which uses the...

osbuild-composer security update

An update is available for osbuild-composer. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A service for building customized OS artifacts, such as VM images a...

PT-2026-89718

Several functions in cstruct may use wrong data, leading to unexpected exceptions and return corrupted data. Impact - Cstruct.filter map writes retained bytes at their original input positions, producing corrupted output when earlier bytes are dropped. - Cstruct.tail rev:true removes two bytes...

PT-2026-89200

🚨 CRITICAL WORDPRESS RCE — A NEW CVSS 9.8 FLAW CAN LET UNAUTHENTICATED ATTACKERS UPLOAD EXECUTABLE FILES. CVE-2026-18351 affects Drag and Drop File Upload for Elementor Forms ≤1.6.0. No login. No user interaction. CyberSignal Priority: 🔴 VERY HIGH 1/8 The flaw is in the plugin's file-upload...

EUVD-2026-74930

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

Important: Red Hat Security Advisory: ignition security update

An update for ignition is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

EUVD-2026-74708

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket...

SUSE CVE-2026-84961

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

NPM: Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

NPM: Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain vulnerability discovered by ? in WordPress Npm nodemailer versions = 6.9.16, 9.1.0...

NPM: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

NPM: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

Summary An embedded line terminator bypasses the requireWellFormed serializer check for element and attribute names. The check was added to fix GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm; a name whose first line is well-formed slips past it and is serialized verbatim, so the characters after the...

GHSA-3PX3-54CX-RMW9 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

Summary An embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name validation. createElementNS, createAttributeNS, createDocumentType, and createAttribute should reject a malformed qualified name with InvalidCharacterError, but a name whose first line is well-form...

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

Summary xmldom's parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. . The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name an...

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...

CVE-2026-78552 Validation Bypass in Okta Access Gateway Custom Directives

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives...

CVE-2026-78552

CVE-2026-78552 is a validation bypass in Okta Access Gateway where the application-level custom configuration field is not subject to the same Lua directive restriction as other fields. Because this field is interpolated directly into the nginx server block without inspection, an authenticated us...

CVE-2026-78552 Validation Bypass in Okta Access Gateway Custom Directives

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives...

CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...