Search: h-w-g.com

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.

CVE-2026-111839 is a missing authorization vulnerability in VideoWhisper.com's Broadcast Live Video product affecting versions prior to 7.3.8. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a medium severity with a CVSS score of 5.3 and impacts confidentiality but not integrity or availability. A fix is available in version 7.3.8.

This update for docker fixes the following issues: Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265782). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266625). - CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be used to bypass some authorization controls (bsc#1262346). - CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into that container (bsc#1267827). Non security issue fixed: - SELinux CIL files are not shipped in Docker (bsc#1278193). Changes for docker: - Update to Docker 29.7.2. See upstream changelog online at <https://docs.docker.com/engine/release-notes/29/#2972> fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176) - Update to buildx 0.36.1. See upstream changelog online at <https://github.com/docker/buildx/releases/tag/v0.36.1>

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265758). - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin (bsc#1261939). - CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification (bsc#1261935). - CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart (bsc#1261938). - CVE-2026-41178: go.opentelemetry.io/otel/baggage,go.opentelemetry.io/otel/propagation: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276510). - CVE-2026-41888: github.com/distribution/distribution/v3: tag deletion bypasses the storage.delete.enabled configuration (bsc#1265428). - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127). - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload (bsc#1271660). - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks (bsc#1276327). - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1271997). - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1281426). - CVE-2026-56864: x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (bsc#1275025). - CVE-2026-56865: x/mod/sumdb/tlog: fix transparency log tile verification bypass (bsc#1275024). - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283642). - CVE-2026-81870: OpenTelemetry-Go: Information disclosure via exporter (bsc#1284104). - CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration (bsc#1281468). - CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission (bsc#1281469). - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal network probing (bsc#1281112). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1276514). Changes for helm: - update to 4.3.0: * feat: Add duration functions * feat(engine): add debug logging when lookup returns empty * feat: add ownership verification before deleting resources * feat: honor SOURCE_DATE_EPOCH for chart archives * feat(rollback): add --description flag to provide rollback reason * fix (internal/plugin): remove zero-width spaces from plugin name comment * fix(loader): do not drop values files ending at a 4096-byte boundary * fix(chart): normalize StampModTimes timestamp to UTC/truncate + Chart.lock reproducibility test * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings * fix(template): regression - route registry messages to stderr in template and show * refactor: lower resync period from one hour to 3 minutes * perf: enable concurrent status computation to prevent multi-minute delays * fix: Improve error reporting for helm template --debug with --show-only- #31185 * fix: fetch logs from all containers in test pods- #32099 * fix(provenance): check error return in Digest and encodeRelease- #32136 * fix panic on repeated IsReachable calls- #32184 * fix: set [pull,push] scope when helm push to a registry(use token auth) - v4- #31211 * Fix missing conflict retry with server-side apply- #32088 * Properly format the extra field in gzipped packages- #31884 * Fix vanishing empty lines- #32327 * fix: pass registry client to downloader.Manager in upgrade- #32400 * chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1- #32450 * fix: bump go.opentelemetry.io/otel to v1.44.0 for GO-2026-5158- #32521 * chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 43e8b7f (Terry Howe) * bump golang.org/x/text to v.0.40.0 * Revert: Fixed a race condition in WaitForDelete where the status observer canceled the watch too early, causing intermittent failures when running a full test suite #32214 * Fixed data race detected by -race flag when concurrent goroutines (upgrade + rollback, install + uninstall) both call GetWaiterWithOptions on the same FailingKubeClient instance #31925 * Fixed helm command success messages writing to stderr instead of stdout. Now correctly outputing to stdout #32056 * Fixed Helm 4 emitting "unable to find exact version" when using version range constraints #31757 * Fixed a race con

This update for google-osconfig-agent fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283672). Changes for google-osconfig-agent: - Update to version 20260928.01 * scalibr linux new metadata support (#1038) * Fix failing to report REBOOTING state during postPatchReboot due to context canceled for Windows VMs (#1055) * Fix os/snap extractor usage (#1053) - Update github.com/klauspost/compress to v1.18.7 (bsc#1283672, CVE-2026-63209) * bump grpc package to new version (#1057) * bump some dependencies across few modules (#1056)

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

This content discusses the development of a phishing URL detector focused on identifying phishing attempts based solely on URL text analysis. The detector achieves about 90% detection on unseen phishing URLs but struggles with false positives and phishing hosted on compromised legitimate sites. It highlights challenges such as phishing URLs hosted on trusted domains like docs.google.com and the difficulty of blocking such domains outright. The tool is open source and intended as a learning resource rather than an active threat report.

CVE-2026-110883 is an authentication bypass vulnerability in VideoWhisper.com's 2Way VideoCalls and Random Chat software. It affects versions from the initial release up to 6.1.5. The flaw allows attackers to bypass authentication mechanisms, potentially leading to unauthorized access. The vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or remediation information is provided in the available data.

CVE-2026-102941 is a high severity vulnerability in the Go library github.com/gomarkdown/markdown, which is used for parsing markdown content. The vulnerability has an impact on availability but does not affect confidentiality or integrity. No specific affected versions or patch information are provided.

`CCtx::init_using_cdict` and `DCtx::init_using_ddict` (`experimental` feature, deprecated) took the dictionary as `&CDict<'b>` and `&DDict<'b>` with only `'b: 'a`, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier (<https://github.com/gyscos/zstd-rs/issues/365>). The flaw was corrected by taking `&'a CDict<'b>` and `&'a DDict<'b>`.

Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.

### Impact A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers causes superlinear time complexity. During the unpack operation, specific file configurations within the layer can trigger repeated directory traversals. Consequently, pulling or importing a maliciously crafted image can result in increased unpack times and a moderate increase in CPU usage. This delays container startup, even if the compressed image layers are small. Additionally, in orchestrators like Kubernetes that apply concurrency limits to image pulls, these excessively long operations can reduce the available concurrency for other pulls, potentially delaying unrelated container deployments. ### Patches This bug has been fixed in containerd 2.3.5, 2.2.8, 2.0.12, and 1.7.35. Users should update to these versions to resolve the issue. ### Workarounds There are no known workarounds for this issue. Users are advised to only pull and import trusted images from known registries until the patch can be applied. ### Credits The containerd project would like to thank Jakub Ciolek of AlphaSense for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md). ### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io) To report a security issue in containerd: * [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new) * Email us at [security@containerd.io](mailto:security@containerd.io)

### Impact A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the `CreateContainer` API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI image, CRIU restores process credentials, Linux capabilities, `no_new_privs`, and seccomp state directly from checkpoint data rather than enforcing the destination CRI `ContainerConfig`. An attacker who can run a container with a crafted checkpoint image can execute processes as root with full capabilities and no enforced seccomp filters despite restrictive security policies requested by the orchestrator. Additionally, containerd's CRI status reporting reflects the requested configuration rather than the actual restored process state, masking the privilege discrepancy from orchestrators. This issue affects Linux systems running containerd with CRI checkpoint restore enabled; users not utilizing CRI checkpoint restore are not affected. ### Patches This bug has been addressed in containerd 2.2.7 and 2.3.4 by disabling checkpoint restore via `CreateContainer` by default. The feature has been removed entirely in containerd 2.4.0. Users should update to these versions to resolve the issue. Running containers that were restored from untrusted checkpoints should be stopped, deleted, and recreated. Users who rely on restore via the `CreateContainer` API can re-enable the feature by setting the new `enable_experimental_restore_via_create` configuration option. However, enabling restore via `CreateContainer` leaves this vulnerability present, as containerd cannot enforce destination security policy during CRIU process restoration. ### Workarounds On unpatched versions, containerd does not provide a configuration option to disable checkpoint restore via `CreateContainer`. Deployments should restrict container creation permissions to trusted users, validate container image registries, or use admission controllers to reject images containing checkpoint data. ### References * [CRIU image security](https://checkpoint-restore.github.io/criu/security/image-security.html) ### Credits The containerd project would like to thank @l2yyd5 and @berkpolatCE for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md). ### For more information If you have any questions or comments about this advisory: * Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose) * Email us at [security@containerd.io](mailto:security@containerd.io) To report a security issue in containerd: * [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new) * Email us at [security@containerd.io](mailto:security@containerd.io)

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.16.73. See the following advisory for the container images for this release: https://access.redhat.com/errata/RHSA-2026:77616 Security Fix(es): * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.

If a certain set of MathML tags are enabled, an attacker can inject arbitrary JavaScript code into the user's browser. The `annotation-xml` tag has slightly different behavior than the other "integration point" tags in MathML and SVG, but ammonia didn't handle it, so it didn't correctly strip the namespace-incompatible tags. This vulnerability only has an effect when the `math` and `annotation-xml` tags are both enabled, but the `encoding` attribute is disabled, because it relies on the following sequence of steps: 1. User writes code like `<math><annotation-xml encoding="text/html"><gadget></annotation-xml></math>`. 2. Namespace filtering checks the DOM, and it passes. `<gadget>` is parsed as HTML. 3. Attribute filter strips it down to `<math><annotation-xml><gadget></annotation-xml></math>`. Because the encoding attribute is gone, `<gadget>` is now parsed as MathML. 4. The gadget is written in such a way that it exploits the parsing differences between HTML and MathML. Additionally, the gadget can only be written using a tag that is parsed as raw text in HTML. These [elements] are: * title * textarea * xmp * iframe * noembed * noframes * plaintext * noscript * style * script Applications that do not explicitly allow any of these tags should not be affected, since none are allowed by default. [elements]: https://github.com/servo/html5ever/blob/045a0378f2b0f8d4a350793899cf722a2a9b3d11/html5ever/src/tree_builder/rules.rs ### Impact Low: Requires both MathML and at least one raw-text HTML tag to be enabled, and most websites don't enable either of those. ### Patches - https://github.com/rust-ammonia/ammonia/pull/245 (released in 4.1.3) - https://github.com/rust-ammonia/ammonia/pull/244 (released in 4.0.2) - https://github.com/rust-ammonia/ammonia/pull/243 (released in 3.3.2) ### Workarounds Call <code>builder.[add_clean_content_tags](https://docs.rs/ammonia/latest/ammonia/struct.Builder.html#method.add_clean_content_tags)("annotation-xml")</code> to remove the annotation-xml element and all of its children, including the XSS gadget.

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/main/java/com/erudika/scoold/utils/HttpUtils.java validates the backto and returnto parameters with Strings.CI.startsWith against the configured server URL. An attacker can supply an absolute URL whose hostname begins with the legitimate hostname, causing URI.resolve() to retain the attacker URL and the prefix check to accept it. A victim who follows the crafted sign-in link can be redirected to an attacker-controlled domain after authentication, enabling phishing and possible credential or token theft. This issue is fixed in version 1.69.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.

## Summary When cache interception is enabled, `@opennextjs/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup. An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware. `enableCacheInterception` is disabled by default. ## Impact A remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware. An application is affected when it: - explicitly enables `enableCacheInterception`; - relies on middleware for access control; and - has a matching cached route. ## Details Middleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry. For example, consider an application with: - middleware matcher `/admin/:path*`; - middleware returning `401 Authentication required` for `/admin`; - a statically generated, cached `/admin` route; and - cache interception enabled: ```ts export default defineCloudflareConfig({ incrementalCache: staticAssetsIncrementalCache, enableCacheInterception: true, }); ``` An attacker can request: ```http GET /%61dmin ``` The encoded pathname does not match `/admin/:path*`, so the authorization middleware is not invoked. Cache interception then decodes `%61dmin` to `admin` and may return the cached `/admin` response: ```http HTTP/1.1 200 OK x-opennext-cache: HIT Protected content ``` Malformed paths exposed an additional inconsistency. For example: ```http GET /%61dmin/%ZZ ``` The previous implementation decoded each segment independently. It decoded `%61dmin` to `admin` but retained the malformed `%ZZ` segment, allowing cache lookup to continue using a partially decoded pathname. ## Patches The fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in [opennextjs-aws#1199](https://github.com/opennextjs/opennextjs-aws/pull/1199) and [opennextjs-aws#1200](https://github.com/opennextjs/opennextjs-aws/pull/1200). Users should upgrade to `@opennextjs/cloudflare@1.20.2` or later. ## Workarounds If upgrading is not immediately possible for an application: 1. Disable cache interception by removing `enableCacheInterception: true`. 2. Enforce authorization inside protected route handlers rather than relying exclusively on middleware. 3. Reject encoded paths for protected routes at a trusted proxy before they reach the Worker. Adding individual encoded matcher variants is not a complete workaround because pathnames can have multiple equivalent encodings.