Vulnérabilités récentes · Page n° 72

Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce ac

LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.

Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys

The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level

Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.

Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configur

Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the affected post page to include an Advanced HTML Element block with Split Text animation enabled wrapping a Latest Comments block that displays comment excerpts, as this configuration causes splittext.js to be e

RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import v

Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to have a publicly accessible page containing an [mla_gallery] shortcode configured with a pagination output mode and an mla_link_href template that reflects a {+request:...+} t

JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'team_id' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reached when the season has no associated joomsport_tournament term, which

Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties[<template-token>]' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a site administrator has previously configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination whose GeoJSON src URL is one the attacker controls — for example,

Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821). - CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387). - CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280). - CVE-2026-99999: ipv4: validate checksum_start before completing checksum (bsc#1285684). The following non security issues were fixed: - ACPI, APEI, EINJ: Subtract any matching Register Region from Trigger resources (git-fixes). - ACPI: sysfs: Fix

• Mettez à jour vers 3.0.101-108.226.1

CVE-2026-88941

Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of Kaspersky Security Center to malfunction. There are no evidence of the vulnerability exploitation in-the-wild.

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).

• Mettez à jour vers 0.105-33ubuntu0.2
• Mettez à jour vers 124-2ubuntu1.24.04.4
• Mettez à jour vers 127-2ubuntu1.1

Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration

A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser once the victim accesses the malicious URL.

Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133). - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864). - CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572). - CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escal

• Mettez à jour vers 2.2.11~git12.1e612cde2-150500.3.54.1

Security update for rust-keylime

This update for rust-keylime fixes the following issue: - CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers (bsc#1287921) - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification (bsc#1287921) - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921) - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921) - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets (bsc#1287921) Changes for rust-keyli

• Mettez à jour vers 0.2.10+12-150500.3.22.1

Security update for rust-keylime

This update for rust-keylime fixes the following issue: - CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers (bsc#1287921) - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification (bsc#1287921) - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921) - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921) - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets (bsc#1287921) Changes for rust-keyli

• Mettez à jour vers 0.2.10+12-150400.3.22.1

SQL Injection Vulnerability in Radius Xenia M2M Platform

This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input fields to the targeted system.  Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to sensitive information, enumerate database structure or modify database records on the targeted system.

Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133). - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864). - CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572). - CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escal

• Mettez à jour vers 2.2.11~git12.1e612cde2-150600.8.38.1