SUSE-SU-2026:3266-1 Security update for ignition

This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...

SUSE-SU-2026:3265-1 Security update for ignition

This update for ignition fixes the following issues - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. - CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invali...

EUVD-2026-49142

proCertum SmartSign opens Certificate Practice Statement CPS URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the...

CVE-2026-57916

proCertum SmartSign opens Certificate Practice Statement CPS URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the...

CVE-2026-17534

Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...

CVE-2026-65764

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability...

CVE-2026-65764 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability...

CVE-2026-65764 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.1.1

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability...

EUVD-2026-49127

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability...

CVE-2026-13597

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

EUVD-2026-49111

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcnsfollow in logreplay conversion logreplay converts DIRPAGEENTRY32 records into DIRPAGEENTRY records when replaying version 0 restart tables. During this conversion, the memmove length is derived directly fro...

CVE-2026-64533 fs/ntfs3: validate lcns_follow in log_replay conversion

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcnsfollow in logreplay conversion logreplay converts DIRPAGEENTRY32 records into DIRPAGEENTRY records when replaying version 0 restart tables. During this conversion, the memmove length is derived directly fro...

CVE-2026-64533 fs/ntfs3: validate lcns_follow in log_replay conversion

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcnsfollow in logreplay conversion logreplay converts DIRPAGEENTRY32 records into DIRPAGEENTRY records when replaying version 0 restart tables. During this conversion, the memmove length is derived directly fro...

xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in glXDispChangeDrawableAttributes. A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapp...

EUVD-2026-49080

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

CVE-2026-14236

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

CVE-2026-14236

The CVE concerns the Contact Form 7 WordPress plugin (pre-2.5) failing to validate the host of a user-supplied return URL before using it as the success and cancel redirect targets for a Stripe checkout. Root cause: lack of host validation on the return URL enables an unauthenticated attacker to ...

CVE-2026-13597

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

EUVD-2026-49073

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

EUVD-2026-49066

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...