CVE-2026-69088

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

EUVD-2026-52281

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

CVE-2026-69088

Grav CMS 2.0.7–2.0.10 is affected by an arbitrary method invocation vulnerability in blueprint dynamic-field directives. The issue arises because Blueprint::isSafeDynamicCall() only applies its denial list to strings without '::', allowing an account with page-editing rights to insert a directive...

CVE-2026-69085 SiYuan before v3.7.3 SQL Injection via searchDocs

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or...

CVE-2026-68587

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by TurboNexic in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.14...

WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.0...

WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.0...

RLSA-2026:47183 Important: compat-libtiff3 security update

The libtiff3 package provides libtiff 3, an older version of libtiff library for manipulating TIFF Tagged Image File Format image format files. This version should be used only if you are unable to use the current version of libtiff. Security Fixes: libtiff: libtiff: Heap-based buffer overflow vi...

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...

RHSA-2026:47058 Red Hat Security Advisory: nodejs:22 security update

Bulletin has no description...

CVE-2026-68743

A flaw was found in SSSD. The extractauthtokv1 function in the PAM responder does not validate the authtokenlength field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds...

EUVD-2026-52256

A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library that could lead to HTTP request smuggling, desynchronization, or RTSP request injection.(CVE-2026-41417).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. A vulnerability in netty could allow an attacker to inject malicious CRLF sequences into request URIs, resulting in HTTP request smuggling, protocol desynchronization, and the execution of unintended HTTP ...

CVE-2026-18590

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function setsysadm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly...

CVE-2026-62416

The CVE-2026-62416 entry concerns Sharp Corporation’s Network Scanner Tool and Network Scanner Tool Lite configured with no authentication, allowing unlimited file uploads over the network. The underlying issue enables an unauthenticated attacker to connect and upload files, potentially causing d...

CVE-2026-15254

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...

EUVD-2026-52227

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

CVE-2026-28147 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...