CVE-2026-65899

The CVE affects DOMPurify 3.0.0 through 3.4.8, where clearConfig() does not reset the retained TRUSTED_TYPES_POLICY. This allows a DOMPurify instance reused across trust boundaries to remain bound to a previously supplied policy, so a later caller requesting RETURN_TRUSTED_TYPE output may receive...

RLSA-2026:42952 Moderate: glibc security update

The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name service cache daemon nscd used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fixes: glibc:...

[SECURITY] Fedora 44 Update: perl-YAML-Syck-1.47-1.fc44

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around...

PT-2026-63996

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

CVE-2026-52439

An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism...

The vulnerability of the ath12k_qmi_driver_event_work() function in the drivers/net/wireless/ath/ath12k/qmi.c file of the Atheros/Qualcomm wireless adapter driver module in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ath12kqmidrivereventwork function in the drivers/net/wireless/ath/ath12k/qmi.c file of the Atheros/Qualcomm wireless communication adapter driver in the Linux operating system is related to improper memory release memory leak. Exploiting this vulnerability could allow an...

PT-2026-64173

Name of the Vulnerable Software and Affected Versions xiandafu beetl version 3.20.2 Description A remote attacker can execute arbitrary code by leveraging the type.new function and the property reflection mechanism. Property reflection is a process that allows a program to inspect and modify its...

CVE-2026-52439

An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism...

The vulnerability of the jv_object_merge_recursive() function in the jq JSON processing tool allows a attacker to cause a service failure.

The vulnerability of the jvobjectmergerecursive function in the jq JSON processing tool is related to an uncontrolled recursion. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-38766

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub186f4 function...

NPM: Next.js: Unauthenticated disclosure of internal Server Function endpoints

NPM: Next.js: Unauthenticated disclosure of internal Server Function endpoints vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

CVE-2026-13065 MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

CVE-2026-16615

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer...

ALPINE-CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-44621

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-44621

The CVE describes a vulnerability in NLnet Labs Unbound up to version 1.25.1 where applications using libunbound and configuring the unwanted-reply-threshold (non-zero) can trigger a fatal exit of libunbound when threshold is exceeded and libworker_alloc_cleanup is not on the function-call allow ...

CVE-2026-44621 Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated

With NLnet Labs Unbound up to and including version 1.25.1, applications using libunbound and configured with 'unwanted-reply-threshold', could eventually be abruptly terminated if the threshold is reached and libunbound needs to call 'libworkeralloccleanup' since the function is absent from the...

CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...