Important: Red Hat Security Advisory: Red Hat Quay 3.15.8

Red Hat Quay 3.15.8 is now available with bug fixes. Quay 3.15.8...

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...

CVE-2026-85309

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...

CVE-2026-84814

Subscriber Privilege Escalation in Bricksforge = 3.1.8.8 versions...

CVE-2026-84848

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

CVE-2026-84813

Unauthenticated SQL Injection in GeoDirectory = 2.8.174 versions...

CVE-2026-84776

Unauthenticated Denial of Service Attack in MalCare Security = 6.69 versions...

CVE-2026-84777

Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...

CVE-2026-84763

Unauthenticated Cross Site Scripting XSS in RTMKit = 2.1.5 versions...

CVE-2026-84765

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

CVE-2026-84766

Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...

CVE-2026-84767

Unauthenticated Bypass Vulnerability in BookIt = 2.6.0.3 versions...

CVE-2026-84761

Unauthenticated Server Side Request Forgery SSRF in LiteSpeed Cache = 7.9 versions...

CVE-2026-84756

Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...

CVE-2026-84755

Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...

CVE-2026-84215

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-84753

Unauthenticated PHP Object Injection in Mail Mint = 1.31.0 versions...

CVE-2026-81292

Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...

CVE-2026-81295

Unauthenticated Cross Site Scripting XSS in Under Construction = 5.82 versions...

CVE-2026-81773

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...