GHSA-39Q2-94RC-95CP DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

Summary In src/purify.ts:1117-1123, ADDTAGS as a function via EXTRAELEMENTHANDLING.tagCheck bypasses FORBIDTAGS due to short-circuit evaluation. The condition: !tagChecktagName && !ALLOWEDTAGStagName || FORBIDTAGStagName When tagChecktagName returns true, the entire condition is false and the...

PT-2026-33380

Name of the Vulnerable Software and Affected Versions zrok versions prior to 2.0.1 Description A logical error exists in the ownership guard of the unaccess handler within the controller/unaccess.go file. When a frontend record has the environment id variable set to NULL, which identifies...

PT-2026-34593

Name of the Vulnerable Software and Affected Versions LangSmith JavaScript SDK versions prior to 0.5.19 LangSmith Python SDK versions prior to 0.7.31 Description Output redaction controls do not apply to streaming token events. When a Large Language Model run produces streaming output, each chunk...

PT-2026-63989

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.0 Description A logic error exists in the ADD TAGS function where short-circuit evaluation allows tags listed in FORBID TAGS to bypass restrictions. This occurs when tags are simultaneously listed in both FORBID...

RHEL 9 : rhc (RHSA-2026:8324)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8324 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...

Fedora: Security Advisory (FEDORA-2026-49fd0d9636)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 8 : rhc (RHSA-2026:8434)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:8434 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...

Fedora 42 : libpng (2026-ba18a54554)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ba18a54554 advisory. 1.6.56 is release fixes for the following two security vulnerabilities: - CVE-2026-33416 high severity: Use-after-free memory bug in the transparenc...

CVE-2026-6359

An use after free flaw was found in the Video component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=490251701...

CVE-2026-6297

An use after free flaw was found in the Proxy component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=493628982...

CVE-2026-6301

A type confusion flaw was found in the Turbofan component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=495273999...

CoinMate.io: POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)

A vulnerability was discovered in the CoinMate API where the POST /api/bitcoinWithdrawalFees endpoint was accessible without authentication, despite being documented as a private endpoint. The endpoint returned real-time Bitcoin withdrawal fee data without requiring any authentication, unlike oth...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nginx: nginx-1.30.0-1.hum1 aarch64, x8664 nginx-all-modules-1.30.0-1.hum1 noarch nginx-core-1.30.0-1.hum1 aarch64, x8664 nginx-filesystem-1.30.0-1.hum1 noarch nginx-mod-devel-1.30.0-1.hum1 aarch6...

kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure

A flaw was found in the Linux kernel's Data Access MONitor DAMON sysfs interface. A local attacker, typically a privileged user, could exploit a cleanup bug during DAMON context setup. If the setup fails after the attrs directory is created, stale sysfs directories are left behind. This can lead ...

CVE-2026-6316

Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.10 bug fix and security update

Red Hat OpenShift Container Platform release 4.21.10 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a...

Always-Incorrect Control Flow Implementation

Overview Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to an inverted time comparison in the OIDC JWKS and token cache processes. An attacker can cause expired tokens to be reused or force repeated network requests to the OIDC provider by...

GHSA-XMJ9-7625-F634 Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache

Affected Components - DSF FHIR Server with enabled bearer-token authentication or back-channel logout. - DSF BPE Server with enabled bearer-token authentication or back-channel logout. - DSF BPE Server API v2 process plugins using FHIR client connections with configured OIDC authentication. Summa...

CVE-2026-6319

CVE-2026-6319 is a Use-after-Free in Google Chrome's Payments component for Android, prior to version 147.0.7727.101. The issue could allow remote code execution when a user is tricked into performing specific UI gestures and visits a crafted HTML page. Public sources (Debian security advisory DS...

CVE-2026-6360

Google Chrome vulnerability CVE-2026-6360: Use-after-free in FileSystem prior to 147.0.7727.101 allows remote exploitation via a crafted HTML page, potentially causing object corruption. Severity: High. Mitigation: upgrade to Chrome 147.0.7727.101 or later.