The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in all versions up to and including 6.11.3. This vulnerability arises from insufficient input sanitization and output escaping of the REQUEST_URI query string, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The vulnerability has a medium severity rating with a CVSS score of 4.7.
A malicious file identified by the SHA-256 hash 4af5a5c98ad132095c6fbe7b02c242153a190a01cc321e50a916a0ca46fbaa62 was observed 618 times in attacker activity between August 4 and August 11, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.
Kiali 2.11.15, for Red Hat OpenShift Service Mesh 3.1, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.
Security Fix(es):
* CVE-2026-59873 openshift-service-mesh/kiali-ossmc-rhel9: node-tar: Denial of Service via crafted gzip bomb (OSSM-14904)
* CVE-2026-59873 openshift-service-mesh/kiali-rhel9: node-tar: Denial of Service via crafted gzip bomb (OSSM-14906)
* CVE-2026-59874 openshift-service-mesh/kiali-rhel9: Node-tar: Denial of Service via malformed tar archive header (OSSM-14910)
* CVE-2026-59874 openshift-service-mesh/kiali-ossmc-rhel9: Node-tar: Denial of Service via malformed tar archive header (OSSM-14914)
* CVE-2026-59869 openshift-service-mesh/kiali-ossmc-rhel9: js-yaml: Denial of Service via crafted YAML documents (OSSM-14923)
* CVE-2026-59869 openshift-service-mesh/kiali-rhel9: js-yaml: Denial of Service via crafted YAML documents (OSSM-14926)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Simply Schedule Appointments WordPress plugin versions before 1.6.12.11 contain an authorization flaw where users with Contributor role and above can access all customers' appointment data site-wide. This occurs because the plugin does not properly check capabilities on an administrative appointment-listing shortcode and fails to restrict results to authorized users only. The exposed data includes names, email addresses, phone numbers, and notes of customers.
## Summary
There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the `nginx.ingress.kubernetes.io/rewrite-target` annotation with a regular expression that captures attacker-controlled text without requiring a path separator (for example path `/api(.*)` with rewrite target `/$1`), the generated `RewriteTarget` middleware can turn an initially safe request path into a dot-segment traversal path after the router has already been selected.
## Patches
- https://github.com/traefik/traefik/releases/tag/v3.7.8
## For more information
If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
<details>
<summary>Original Description</summary>
## Summary
Traefik's Kubernetes Ingress NGINX provider creates an internal `RewriteTarget` middleware for the `nginx.ingress.kubernetes.io/rewrite-target` annotation. When an Ingress path captures attacker-controlled text without requiring a path separator, the middleware can turn an initially safe path into a dot-segment traversal path after Traefik has already selected the router.
For example, with Ingress path `/api(.*)` and rewrite target `/$1`, an unauthenticated request to `/api../admin` follows this flow:
1. The default entry-point path sanitizer leaves `/api../admin` unchanged because `api..` is one ordinary segment.
2. The public router's `PathRegexp("(?i)^/api(.*)")` rule matches.
3. `RewriteTarget` captures `../admin` and creates `/../admin`.
4. The middleware forwards `/../admin` without checking whether path normalization changes it.
5. A backend that normalizes paths resolves `/../admin` to `/admin`.
6. The request reaches content intended to be reachable only through a separate `/admin` router with BasicAuth, DigestAuth, or ForwardAuth.
This is an unpatched sibling of [GHSA-cxjq-mrr5-89rv](https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv), which added post-replacement normalization validation to `ReplacePathRegex`. The separate ingress-nginx `RewriteTarget` implementation did not receive the same validation. The bypass remains exploitable in the patched Traefik v3.7.7 release.
## Severity
**Proposed severity:** Critical
**CVSS 3.1:** 9.1 — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
- Attack vector: Network
- Attack complexity: Low once the affected routing pattern exists
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Confidentiality: High
- Integrity: High
- Availability: None
**Primary weakness:** CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
**Secondary weakness:** CWE-288 — Authentication Bypass Using an Alternate Path or Channel
The practical impact depends on the protected backend paths. If they are read-only or low sensitivity, environmental severity may be lower.
### Exploitation Preconditions
- The Kubernetes Ingress NGINX provider is enabled.
- A public Ingress uses `rewrite-target` with a regex that can capture `..` adjacent to the matched prefix, such as `/api(.*)` with `/$1`.
- A protected router exposes another path on the same backend, such as `/admin`, and relies on a Traefik authentication or authorization middleware.
- The backend normalizes dot segments before dispatching the request.
These are deployment prerequisites; the remote attacker needs no credentials or special timing.
## Affected Components
### Confirmed versions
- Traefik v3.7.0 through v3.7.7
- Current `master` at commit `b93f02cd07b79490fb8c8f02e301a7a1ec553195`
- Current `v3.7` branch at `69259c3acc9d4bdc065cb2e3b83336f7de3e7038`
The vulnerable middleware is present in every stable v3.7 release checked. The v2.11 and v3.6 branches do not contain this ingress-nginx `RewriteTarget` implementation.
### Code locations
- `pkg/provider/kubernetes/ingress-nginx/middleware.go:257-274`
- Converts the Ingress path and `rewrite-target` annotation directly into `dynamic.RewriteTarget` configuration.
- `pkg/middlewares/ingressnginx/rewritetarget/rewrite_target.go:85-157`
- Performs capture-based path rewriting and forwards the rewritten path without normalization validation.
- `pkg/server/middleware/middlewares.go:346-353`
- Instantiates the vulnerable middleware in the live HTTP chain.
## Root Cause
The provider passes the route regex and annotation replacement into the middleware:
```go
loc.RewriteTarget = &dynamic.RewriteTarget{
Regex: loc.Path,
Replacement: rewrite,
}
```
`RewriteTarget.ServeHTTP` then derives a path from attacker-controlled capture groups:
```go
newTarget = rt.regexp.ReplaceAllString(currentPath, rt.replacement)
req.URL.RawPath = newTarget
req.URL.Path, err = url.PathUnescape(req.URL.RawPath)
req.RequestURI = req.URL.RequestURI()
rt.next.ServeHTTP(rw, req)
```
There is no invariant check between `PathUnescape` and forwarding to ensure that `req.URL.Path` equals its normalized form. Because routing happen
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Multiple security issues have been fixed in the python311-3.11.15-8.1 package on the GA media of openSUSE Tumbleweed. These fixes address vulnerabilities identified by several CVEs, including CVE-2026-0864 and others. No specific details about the nature of these vulnerabilities or their impact are provided.
A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, parse_browser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Agent in a processed access log to write one to four attacker-influenced bytes beyond the heap allocation and corrupt or crash GoAccess. This issue is fixed in version 1.11.
IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
A vulnerability in GitLab CE/EE versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 could allow an unauthenticated user to cause a denial of service. The issue arises from insufficient resource throttling when processing merge request discussions. This vulnerability has been remediated in the specified fixed versions.
A vulnerability in Zitadel's user self-management API allowed users to mark their email and phone as verified without completing the actual verification process. This was due to improper permission checks that enabled users to retrieve verification codes for email and phone numbers they do not control. The issue affects Zitadel versions 4.0.0 through 4.15.0, 3.0.0 through 3.4.10, and 2.43.0 through 2.71.19. The vulnerability has been fixed in versions 4.15.1 and later, 3.4.11 and later, and 3.4.11 and later for the respective branches. Users are advised to upgrade to these patched versions to mitigate the risk. If upgrading is not possible, a workaround exists to prevent returning verification codes to the user.
Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Apache Traffic Server leaks memory when handling HostDB SRV records.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.