UBUNTU-CVE-2026-74317

In the Linux kernel, the following vulnerability has been resolved: ixgbe: do not configure xps for XDP queues netifsetxpsqueue should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs =64, on E610 adapter, netdev is configured with maximu...

CVE-2026-68456

In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect ueagle-atm uses the asynchronous requestfirmwarenowait in .probe, but does not wait for its completion, not even in .disconnect; so, if the device is unplugged...

CVE-2026-74338

CVE-2026-74338 concerns the Linux kernel: a BPF_LSM_CGROUP sleepable program could be loaded in a context where sleeping is disallowed, triggering a BUG from sleeping in an invalid context during file_open. The fix adds verifier support to reject loading sleepable BPF_LSM_CGROUP programs destined...

CVE-2026-50029

Affects js-toml prior to 1.1.2. The parser uses if (object[key]) to decide duplicates, causing falsy primitives (false, 0, 0n, 0.0, -0, "") to be overwritten by later keys; this yields structural type confusion in load() output (e.g., isAdmin becomes truthy object). MITRE/ATT&CK not specified in ...

GO-2024-3212 vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller, aws-load-balancer-controller-fips...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: amazon-k8s-cni-fips, flux-helm-controller, metacontroller, flux-source-watcher, grafana-operator, flux-notification-controller, victorialogs, grafana-rollout-operator, podinfo, aws-ebs-csi-driver-fips, stakater-reloader, victoriametrics, nova, victoriametrics-cluster...

GO-2024-3212 vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller...

GO-2026-4441 vulnerabilities

Vulnerabilities for packages: wuzz, gitness, fuse-overlayfs-snapshotter, k8s-device-plugin, k3s, aws-load-balancer-controller, runc...

GO-2026-4440 vulnerabilities

Vulnerabilities for packages: wuzz, gitness, fuse-overlayfs-snapshotter, k8s-device-plugin, k3s, aws-load-balancer-controller, runc...

CVE-2026-18109

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-18109

The CVE-2026-18109 entry concerns the W3 Total Cache WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in all versions up to and including 2.10.3 due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject scripts that execute when u...

CVE-2026-18109 W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

EUVD-2026-58570

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

VulnCheck KEV: CVE-2026-18109

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

EUVD-2026-40240

nltk: Arbitrary File Read via Path Traversal in nltk.data.load through Percent-Encoded Sequences...

CVE-2026-73643 js-yaml: Exponential parsing time in the flow collections leads to denial of service

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...

CVE-2026-73643

js-yaml versions 5.0.0–5.2.2 expose a denial-of-service via exponential parsing time when loading untrusted YAML. In src/parser/parser.ts, readFlowCollection can double-parse nested flow sequences, causing O(2^n) work and potential CPU exhaustion for inputs under 200 bytes. Fixed in version 5.2.2...

CVE-2026-13048

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2026-55401

CVE-2026-55401 is a null dereference vulnerability on the load-balancing sub-system of Secure Access servers prior to 14.57. Attackers can send an unauthenticated packet to a Secure Access server with load balancing enabled, which results in the internal load balancer crashing. After a successful...

CVE-2026-55401

CVE-2026-55401 describes a null dereference in the load-balancing sub-system of Secure Access servers prior to version 14.57. An unauthenticated packet directed to a server with load balancing enabled can trigger a crash of the internal load balancer. The impact is that the server remains able to...