CVE-2026-102626 LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the datemin attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted...

CVE-2021-30809-OOM

CVE-2021-30809 — Apple WebKit 释放后重用漏洞（崩溃 PoC） https://github.com/user-attachments/assets/e81f8a01-d48d-44cc-a38f-ce59b01222d5 概述 本仓库包含一个针对 CVE-2021-30809（WebKit 释放后重用漏洞）的极简崩溃触发框架。PoC 通过处理精心构造的 Web 内容来利用漏洞代码路径，旨在可靠地触发浏览器崩溃（非完整利用）。它严格用于研究、调试和回归测试。 目标引擎：WebKit（例如 WebKitGTK / WPE WebKit，内嵌于设备中的旧版本分支）...

perl-Date-Manip security update

6.85-3.1 - Fix CVE-2026-60075: prevent ReDoS via long whitespace runs in date/time parsing Related: RHEL-239797...

Oracle Linux 8 : perl-Date-Manip (ELSA-2026-57562)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-57562 advisory. - Fix CVE-2026-60075: prevent ReDoS via crafted strings with long interior whitespace runs in date/time parsing Tenable has extracted the preceding description...

Oracle Linux 9 : perl-Date-Manip (ELSA-2026-56970)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-56970 advisory. 6.85-3.1 - Fix CVE-2026-60075: prevent ReDoS via long whitespace runs in date/time parsing Related: RHEL-239797 Tenable has extracted the preceding description...

mingw-glib2 security update

2.70.1-9 - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 2.70.1-8 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves: RHEL-212184 2.70.1-7 - Fix CVE-2026-58013: memcmp buffer over-read in giochannel Resolves: RHEL-212234 2.70.1-6 - Fix CVE-2026-58012...

CVE-2026-11881 Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

CVE-2026-11881

The Fluent Forms WordPress plugin versions prior to 6.2.6 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape specific form field configuration settings before they are outputted within an inline script during form rendering. An attac...

SUSE-SU-2026:3341-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2026-58010: error during gvstupleisnormal alignment validation could cause a 1-byte out-of-bounds read bsc1270009. - CVE-2026-58011: invalid GDateTime in gdatetimegetymd could trigger a 2-byte out-of-bounds read bsc1270010. - CVE-2026-58012:...

OESA-2026-3112 glib2 security update

GLib is a bundle of three formerly five low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fixes: A flaw was found in GLib. An off-by-one...

CVE-2026-59525

creationtimestamp| type| source ---|---|--- 2026-07-23 13:00:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrcveuesah2v...

CVE-2026-49208

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a LiveProp is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue falls back to new $className$value, allowing client-supplied...

CVE-2026-49208 Symfony UX: Format-less date LiveProps parsed with the permissive DateTime constructor

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a LiveProp is typed as DateTimeInterface and no explicit format is configured, Symfony\UX\LiveComponent\LiveComponentHydrator::hydrateObjectValue falls back to new $className$value, allowing client-supplied...

libsoup3 security update

3.6.5-11 - Add patches for CVE-2026-4271 and CVE-2026-5119 3.6.5-10 - Add patch for CVE-2026-1761 3.6.5-9 - Fix CVE-2026-0719 3.6.5-8 - Fix CVE-2025-14523 3.6.5-7 - Add patch for CVE-2025-12105 3.6.5-6 - Fix integer overflow in date/time parsing 3.6.5-5 - Bump revision number 3.6.5-4 - Fix severa...

glib2: Fix of 2 CVEs

CVE-2026-58011: out-of-bounds read from an invalid GDateTime produced by gdatetimeaddfull without range validation, later read by gdatetimegetymd - CVE-2026-58013: heap buffer over-read in giochannelreadlinebackend when a multi-byte line terminator is memcmp'd past the end of the buffer...

[SECURITY] Fedora 43 Update: python-pendulum-3.2.0-1.fc43

Unlike other datetime libraries for Python, Pendulum is a drop-in replacement for the standard datetime class it inherits from it, so, basically, you can replace all your datetime instances by DateTime instances in you code. It also removes the notion of naive datetimes: each Pendulum instance is...

CVE-2026-0282

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:50+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5spheeb723 2026-07-09 04:46:18+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260709 2026-07-09 21:04:25+00:00| seen...

CVE-2026-53340

creationtimestamp| type| source ---|---|--- 2026-07-01 22:26:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmkrk2x5l2r 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

AZL-91439 CVE-2026-58011 affecting package glib for versions less than 2.78.6-11

A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the gdatetimegetymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the gdatetimeaddfull function is processed. This flaw can corrupt the date output and potentially cause logic errors...

CVE-2026-58011

A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the gdatetimegetymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the gdatetimeaddfull function is processed. This flaw can corrupt the date output and potentially cause logic errors...