124 matches found
CVE-2026-16537
The CVE details a Stored XSS vulnerability in the Slick Slider WordPress plugin, version before 0.5.3. The issue arises because a shortcode attribute value is not sanitized/escaped before being output into an HTML attribute, enabling attackers with the Contributor role or higher to execute script...
CLSA-2026-1774830279 TuxCare security update for negotiator (1 CVE)
TuxCare rebuilt negotiator to address 1 CVE. Fixed in 0.5.3-tuxcare.1...
CLSA-2026-1774830278 TuxCare security update for passport (1 CVE)
TuxCare rebuilt passport to address 1 CVE. Fixed in 0.5.3-tuxcare.1...
CLSA-2026-1774311624 TuxCare security update for printf (1 CVE)
TuxCare rebuilt printf to address 1 CVE. Fixed in 0.5.3-tuxcare.1...
CVE-2026-17531
CVE-2026-17531 affects unitedbyai droidclaw up to version 0.5.3. The vulnerability is in an unspecified aspect of file server/src/routes/goals.ts (Unsigned Scheduled Callback) and enables authorization bypass. Remote exploitation is possible, with high complexity and a PROOF-OF-CONCEPT exploit pu...
CVE-2026-12250
The CVE-2026-12250 entry concerns Pardus Domain Joiner (TUBITAK BILGEM Software Technologies Research Institute). A vulnerability described as an Invocation of process using visible sensitive information could allow Excavation (data exposure). Affected version range: Pardus Domain Joiner 0.5.2 pr...
PT-2026-53343
These are all security issues fixed in the jupyter-jupyterlab-templates-0.5.3-2.1 package on the GA media of openSUSE Tumbleweed...
fluent-plugin-opentelemetry Has Denial of Service (DoS) via Large Payloads and Decompression Bombs in `in_opentelemetry`
The fluent-plugin-opentelemetry plugin specifically the inopentelemetry HTTP input lacked strict size limits on incoming requests. It was discovered that the plugin read the entire request body and decompressed payloads into memory without enforcing maximum size thresholds. If the OpenTelemetry...
CVE-2026-46654 Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
Plonky3 is a toolkit for polynomial IOPs PIOPs. Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5...
CVE-2026-46654 Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
Plonky3 is a toolkit for polynomial IOPs PIOPs. Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side observations can craft distinct transcripts that produce identical challenges, breaking the binding property of Fiat-Shamir. This issue has been patched in versions 0.4.3 and 0.5...
EEF-CVE-2026-49756 Multipart form-data header injection in Req via unescaped name/filename/content_type
Summary Improper Neutralization of CRLF Sequences 'CRLF Injection' vulnerability in wojtekmach Req allows multipart parameter smuggling via attacker-influenced part metadata. Req.Utils.encode\form\part/2 in lib/req/utils.ex builds the per-part headers by interpolating the caller-supplied name,...
EUVD-2026-33537
A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. The affected element is an unknown function of the file server/src/routes/pairing.ts of the component claim Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be launched...
CVE-2026-10216
The CVE-2026-10216 entry concerns unitedbyai droidclaw (
Fedora 44 : libcgif (2026-7fd284c688)
The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7fd284c688 advisory. Version 0.5.3 - Fix potential undefined behavior in cgifaddframe which could have led to an integer overflow CVE-2026-4985 Tenable has extracted the precedin...
[SECURITY] Fedora 43 Update: rust-btrd-0.5.3-12.fc43
The btrfs debugger...
CVE-2022-0338
Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3...
CVE-2025-23826
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pedjas Stop Comment Spam stop-comment-spam allows Stored XSS.This issue affects Stop Comment Spam: from n/a through = 0.5.3...
CVE-2025-67744 Mermaid XSS vulnerability leads to Remote Code Execution
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. Due to the exposure of the Electron IPC renderer...
GHSA-FMH4-WR37-44FP React Server Components are Vulnerable to RCE
Summary @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained an unauthenticated remote code execution vulnerability in versions prior to 19.0.1, 19.1.2, and 19.2.1. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r...