CVE-2026-53963: Stored XSS in Discourse Second Factor Dialog
CVE-2026-53963 is a stored XSS in Discourse, fixed in 2026.6.0, 2026.5.1, 2026.4.2 and 2026.1.5. Update your forum, especially if admins impersonate users.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
CVE-2026-53963 is a stored XSS in Discourse, fixed in 2026.6.0, 2026.5.1, 2026.4.2 and 2026.1.5. Update your forum, especially if admins impersonate users.
CVE-2026-5257 is a SQL injection in code-projects Simple Laundry System 1.0 via userid in delstaffinfo.php. No fix named; restrict access, fix the query.
CVE-2026-51846 is a critical stack overflow in Tenda AC7 V15.03.06.44 via wanSpeed. No fix is named; block remote admin and watch for new firmware.
CVE-2026-51845 is a critical stack overflow in Tenda AC7 V15.03.06.44 via mac. No fix is named; block remote admin and watch for new firmware.
CVE-2026-51844 is a critical stack overflow in Tenda AC7 V15.03.06.44 via cloneType. No fix is named; block remote admin and watch for new firmware.
CVE-2026-51843 is a critical stack overflow in Tenda AC7 V15.03.06.44 via wanMTU. No fix is named; block remote admin and watch for new firmware.
CVE-2026-50694 is a use after free in Windows Secure Socket Tunneling Protocol scored 8.1 high. Install the Microsoft update and review who runs SSTP.
CVE-2026-50487 is a use after free in Windows DNS scored 8.1 high, affecting Windows 11 and Server 2025. Install the Microsoft update for your build.
CVE-2026-50439 is a use after free in the Windows Message Queuing Queue Manager scored 8.1 high. Install the Microsoft update and disable MSMQ if unused.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.