CVE-2026-16537

The Slick Slider WordPress plugin, in versions prior to 0.5.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape a shortcode attribute value before it is outputted into an HTML attribute. This flaw allows users with the Contributor...

CLSA-2026-1774830279 TuxCare security update for negotiator (1 CVE)

TuxCare rebuilt negotiator to address 1 CVE. Fixed in 0.5.3-tuxcare.1...

CLSA-2026-1774830278 TuxCare security update for passport (1 CVE)

TuxCare rebuilt passport to address 1 CVE. Fixed in 0.5.3-tuxcare.1...

CLSA-2026-1774311624 TuxCare security update for printf (1 CVE)

TuxCare rebuilt printf to address 1 CVE. Fixed in 0.5.3-tuxcare.1...

CVE-2026-17531

CVE-2026-17531 affects unitedbyai droidclaw up to version 0.5.3. The vulnerability is in an unspecified aspect of file server/src/routes/goals.ts (Unsigned Scheduled Callback) and enables authorization bypass. Remote exploitation is possible, with high complexity and a PROOF-OF-CONCEPT exploit pu...

PT-2026-65061

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

CVE-2026-12250

The CVE-2026-12250 entry concerns Pardus Domain Joiner (TUBITAK BILGEM Software Technologies Research Institute). A vulnerability described as an Invocation of process using visible sensitive information could allow Excavation (data exposure). Affected version range: Pardus Domain Joiner 0.5.2 pr...

PT-2026-53343

These are all security issues fixed in the jupyter-jupyterlab-templates-0.5.3-2.1 package on the GA media of openSUSE Tumbleweed...

fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`

The fluent-plugin-opentelemetry plugin specifically the inopentelemetry HTTP input lacked strict size limits on incoming requests. It was discovered that the plugin read the entire request body and decompressed payloads into memory without enforcing maximum size thresholds. If the OpenTelemetry...

CVE-2026-46654 Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

Plonky3 is a toolkit for polynomial IOPs PIOPs. Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5...

CVE-2026-46654 Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

Plonky3 is a toolkit for polynomial IOPs PIOPs. Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5...

EEF-CVE-2026-49756 Multipart form-data header injection in Req via unescaped name/filename/content_type

Summary Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode\form\part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name,...

CVE-2026-10216

The CVE-2026-10216 entry concerns unitedbyai droidclaw (

EUVD-2026-33537

A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the component claim Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be launched...

Fedora 44 : libcgif (2026-7fd284c688)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7fd284c688 advisory. Version 0.5.3 - Fix potential undefined behavior in cgifaddframe which could have led to an integer overflow CVE-2026-4985 Tenable has extracted the precedin...

[SECURITY] Fedora 43 Update: rust-btrd-0.5.3-12.fc43

The btrfs debugger...

CVE-2022-0338

Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3...

CVE-2025-23826

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pedjas Stop Comment Spam stop-comment-spam allows Stored XSS.This issue affects Stop Comment Spam: from n/a through = 0.5.3...

CVE-2025-67744 Mermaid XSS vulnerability leads to Remote Code Execution

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. Due to the exposure of the Electron IPC renderer...

GHSA-FMH4-WR37-44FP React Server Components are Vulnerable to RCE

Summary @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained an unauthenticated remote code execution vulnerability in versions prior to 19.0.1, 19.1.2, and 19.2.1. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r...