CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

K000162387: PostgreSQL vulnerability CVE-2026-6476

Security Advisory Description SQL injection in PostgreSQL pgcreatesubscriber allows an attacker with pgcreatesubscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pgcreatesubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18...

EUVD-2026-42343

pypdf: Possible large memory usage for wrong image dimensions...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +53 more potentially affected by CVE-2026-73418 via next-auth (>=4.1.2, <=4.24.13)

next-auth NPM version =4.1.2, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73418 Source advisory: OSV:GHSA-XMF8-CVQR-RFGJ...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +53 more potentially affected by unknown CVE via next-auth (>=4.0.0-beta.6, <=4.24.13)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTAUTH-18306841...

@chirpy-dev/analytics (0.0.1), @chirpy-dev/bootstrapper (0.1.0) +53 more potentially affected by CVE-2026-73419 via next-auth (>=4.0.0-beta.6, <=4.24.13)

next-auth NPM version =4.0.0-beta.6, =0.1.0, =1.9.0, =1.9.9, =0.1.0-0, =1.5.0, =0.0.2, =1.0.0, =1.0.0, =0.0.0-experimental-20231123101256, =5.1.0 and more Source cves: CVE-2026-73419 Source advisory: OSV:GHSA-X445-F3H2-J279...

@12-apps/app-shell (>=1.0.0, <=5.7.0), @12-apps/auth (>=1.2.0, <=2.21.0) +280 more potentially affected by CVE-2026-73419 via @auth/core (>=0.0.0-manual.fdbc96ab, <=0.41.2)

@auth/core NPM version =0.0.0-manual.fdbc96ab, =1.0.0, =1.2.0, =1.3.0, =3.0.0, =4.11.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =1.0.1 - @anish-karthik/create-next-app 1.0.1 - @api-buddy/cli 3.0.5 - @api-buddy/plugin-auth-firebase 3.0.3 - @aponia.js/adapter-prisma 0.2.0 and more Source cves:...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.7.10...

CVE-2026-65608

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

CVE-2026-65533

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

CVE-2026-65514

Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...

CVE-2026-65470

Contributor Cross Site Scripting XSS in Fluent Support = 2.3.0 versions...

CVE-2026-65465

Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.1.1 versions...

CVE-2026-65449

Contributor Cross Site Scripting XSS in MapSVG = 8.14.0 versions...

CVE-2026-59545

Unauthenticated Broken Authentication in miniOrange Discord Integration = 2.2.4 versions...

CVE-2026-59542

Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...

CVE-2026-25405

Contributor SQL Injection in eRoom = 1.7.1 versions...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory

Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...

PYSEC-2026-3472 jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the alloworiginpat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This allow...