PYSEC-2026-3561 `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

Summary datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form "..." with a literal \r escape, is rendered into a Python comment by a Jinja2 filter that...

smb: client: reject userspace cifs.spnego descriptions

...

Gainsight Assist 安全漏洞

Gainsight Assist is a customer communication template management tool developed by Gainsight Inc. There is a security vulnerability in Gainsight Assist, which stems from improper handling of the errordescription parameter. This vulnerability may lead to reflective cross-site scripting attacks...

Oracle Linux 10 / 9 : dtrace (ELSA-2026-50153)

The remote Oracle Linux 10 / 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-50153 advisory. 2.0.6-1 - Fix dtprobed unsafe probe description handling CVE-2026-21991. Orabug: 39054018 Credit Statement: The following people or organizations reported...

Polylang 1.5.1 - User Description H&ling Stored XSS

The Polylang WordPress plugin was affected by an User Description H Stored XSS security vulnerability...