CVEs published August 23, 2026

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges

A vulnerability was found in Comfast CF-N1-S 2.6.0.1.

justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown().

But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by quotes plus NULL, which is length + 3 bytes.

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting.

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several…

The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a…

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4.

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated…

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data.

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service.

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification.

A vulnerability has been found in Tenda CH22 1.0.0.1.

A security flaw has been discovered in Tenda CH22 1.0.0.1.

A vulnerability was found in ggml-org llama.cpp bec4772f6.

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0.

A vulnerability was identified in vas3k TaxHacker up to 0.8.2.

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.9.8 via the…

A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0.

A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0.

A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0.

A vulnerability was determined in vas3k TaxHacker up to 0.8.2.

A flaw has been found in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.

A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.

justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in the serialization of raw-text elements such as <style> and <script>.

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries.

justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses event handler removal in selectedcontent projections.

justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling.

justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g.,…

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content.

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0.

A vulnerability was determined in alexta69 MeTube up to 2026.06.10.

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line.

A flaw has been found in Dromara UJCMS up to 10.1.3.

A vulnerability has been found in CTFd up to 3.8.4.

A vulnerability was found in SourceCodester Stock Management System 1.0.

A vulnerability has been found in SourceCodester Stock Management System 1.0.

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0.

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0.

Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5.

The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with…

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey.

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on…