•about 6 hours ago•CVE-2026-58263
7.2CVE-2026-58263: Mutation Cross-Site Scripting (mXSS) in Jodit Editor clean-html Sanitizer
CVE-2026-58263 is a high-severity Mutation Cross-Site Scripting (mXSS) vulnerability affecting Jodit Editor prior to version 4.12.28. The flaw exists in Jodit's built-in clean-html sanitizer plugin, which fails to securely parse and sanitize nested elements containing foreign namespaces like MathML and SVG. Attackers can bypass sanitization by smuggling malicious payload elements inside rawtext container tags like style inside a MathML node, leading to DOM mutation and unauthenticated arbitrary script execution in the context of the user's browser session.
5 views•6 min read
•about 7 hours ago•CVE-2026-65841
5.3CVE-2026-65841: Client-Side Cross-Site Scripting (XSS) via Foreign Namespace Sanitization Bypass in Jodit Editor
Jodit Editor versions prior to 4.13.6 are vulnerable to client-side Cross-Site Scripting (XSS). The clean-html plugin's sanitization routine performs case-sensitive lookups against uppercase-only element blacklists. When processing XML-based foreign namespaces such as SVG or MathML, DOM engines preserve the lowercase format of tags. Because Jodit's denyTags check fails to normalize tag casing, malicious script blocks nested inside foreign namespace elements completely bypass validation and serialize directly into the editor output.
5 views•6 min read
•about 8 hours ago•CVE-2026-53510
8.1CVE-2026-53510: Remote Code Execution via Dynamic WSDL Parsing in Savon Ruby SOAP Client
A critical code injection vulnerability exists in Savon, a widely used SOAP client library for Ruby, prior to version 2.17.2. The vulnerability resides within the Savon::Model.all_operations module, where operation names fetched from a target Web Services Description Language (WSDL) document are dynamically evaluated via module_eval without sanitization. An attacker capable of manipulating the target WSDL document (e.g., through Man-in-the-Middle attacks, DNS hijacking, or Server-Side Request Forgery) can execute arbitrary Ruby code in the context of the parent application process.
6 views•6 min read
•about 9 hours ago•CVE-2026-53466
6.5CVE-2026-53466: Integer Conversion Overflow in ImageMagick XCF Decoder
An integer conversion overflow vulnerability exists in the XCF decoder of ImageMagick before version 6.9.13-51 and 7.1.2-26. The issue arises from mixed-type arithmetic that promotes calculation results to floating-point representations, causing an undefined cast back to integer. Under optimizing compilers, this undefined behavior results in bounds checks being bypassed, allowing out-of-bounds heap reads.
4 views•6 min read
•about 10 hours ago•CVE-2026-53599
7.5CVE-2026-53599: Authenticated Remote Code Execution in REDAXO CMS via Mediapool File Upload Validation Bypass
An authenticated file upload validation bypass vulnerability exists in the REDAXO CMS Mediapool addon in versions 5.18.2 through 5.21.0. Under permissive web server configurations, this allows authenticated users with media upload privileges to achieve remote code execution via multi-segment extension file uploads.
5 views•7 min read
•about 11 hours ago•CVE-2026-52887
10.0CVE-2026-52887: Critical SQL Injection and Remote Code Execution in NocoBase
A critical SQL injection vulnerability exists in the @nocobase/plugin-notification-in-app-message plugin of NocoBase prior to version 2.0.61. The flaw is caused by direct string interpolation of user-controlled input into a Sequelize.literal() query, allowing authenticated users to execute stacked PostgreSQL queries and achieve remote code execution on the underlying database server.
7 views•7 min read
•about 12 hours ago•CVE-2026-53606
5.4CVE-2026-53606: Stored Cross-Site Scripting (XSS) via Unsanitized URI-bearing Attributes in sanitize-html
An incomplete default configuration vulnerability in sanitize-html prior to version 2.17.5 allows remote attackers to execute arbitrary JavaScript code via crafted HTML payloads containing neglected URI-bearing attributes (e.g., action, formaction, data, xlink:href) that bypass input validation logic.
5 views•6 min read
•about 13 hours ago•CVE-2026-53609
9.1CVE-2026-53609: Server-Side Prototype Pollution in ApostropheCMS
A critical server-side prototype pollution vulnerability in ApostropheCMS versions up to and including 4.30.0 allows authenticated editors to write arbitrary properties to the global Object.prototype via patch operators. Exploiting a confirmed gadget in publicApiCheck() bypasses authorization on all piece-type REST API endpoints framework-wide, persisting for the lifetime of the Node.js process.
4 views•6 min read
•about 14 hours ago•CVE-2026-53607
3.7CVE-2026-53607: Server-Side Request Forgery in ApostropheCMS via Host Header Manipulation
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in ApostropheCMS versions up to and including 4.30.0. When the prettyUrls option is enabled in the @apostrophecms/file module, the server constructs internal self-requests using the client-provided HTTP Host header, allowing remote attackers to coerce the server into initiating outbound requests to arbitrary internal or external hosts.
4 views•8 min read
•about 15 hours ago•CVE-2026-53608
8.7CVE-2026-53608: Stored Cross-Site Scripting in @apostrophecms/seo via Unsanitized Tracking IDs
A stored Cross-Site Scripting (XSS) vulnerability exists in the @apostrophecms/seo package of the ApostropheCMS ecosystem up to and including version 1.4.2. Unsanitized user inputs for Google Analytics and Google Tag Manager IDs are injected directly into script elements within the document header, enabling authenticated editors to execute arbitrary JavaScript in the context of all site visitors.
6 views•5 min read
•about 16 hours ago•CVE-2026-54909
5.3CVE-2026-54909: Remote Denial of Service in Pion STUN via Malformed XOR-MAPPED-ADDRESS Attribute
A remote denial of service vulnerability exists in the pion/stun package before version 3.1.3. A malformed STUN packet containing a short or empty XOR-MAPPED-ADDRESS attribute triggers a runtime slice-bounds panic during parsing, terminating the entire Go process.
5 views•6 min read
•about 17 hours ago•CVE-2026-54908
6.3CVE-2026-54908: Remote Denial of Service via Out-of-Bounds Read in Pion DTLS Handshake Parsing
CVE-2026-54908 is a Denial of Service (DoS) vulnerability in the Pion DTLS library, where a malformed ServerKeyExchange message triggers an uncaught out-of-bounds slice read panic during handshake unmarshaling, terminating the hosting application process.
7 views•6 min read