EUVD-2026-81325

Transient DOS when processing authentication frames with invalid FILS information element header lengths...

CVE-2026-66574: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

CVE-2026-25275: Buffer Over-read

Transient DOS when processing authentication frames with invalid FILS information element header lengths...

CVE-2026-56795: Uncontrolled Search Path Element

Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-92590

Craft CMS versions 5.7.0 through 5.10.12 are affected by a stored cross-site scripting (XSS) vulnerability in the Generated Fields feature. The root cause is the disabling of Twig autoescaping combined with a failure to encode cached values , allowing content editors to inject malicious JavaScrip...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in sanitize-html

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in sanitize-html Vulnerability Details CVEID:CVE-2026-44990 DESCRIPTION: ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under...

ROS-20260916-73-0067

The vulnerability in the fs/btrfs/transaction.c component of the Linux operating system is related to incorrect handling of structure elements. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-55691 EmbedVideo Extension : Stored XSS via unsanitized class passed to template

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedHtmlFormatter::toHtml in includes/EmbedService/EmbedHtmlFormatter.php passes the user-supplied class...

CVE-2026-91846

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves...

CVE-2026-91846 MISP Collection Element Add Missing Authorization on Referenced Object UUID

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves...

CVE-2026-91846 MISP Collection Element Add Missing Authorization on Referenced Object UUID

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves...

CVE-2026-91846

MISP (≤2.5.45) contains a missing authorization check when adding collection elements from a bare UUID. Because collection elements only store UUIDs that are resolved later by the collection view, the generic add() path could persist a UUID for an Event or Galaxy Cluster that the acting user coul...

CVE-2026-91846 MISP Collection Element Add Missing Authorization on Referenced Object UUID

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves...

EUVD-2026-78328

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves...

Chromium CVE-2026-87530: Uncontrolled search path element in CredentialProvider

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium CVE-2026-87459: Observable discrepancy in Select

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-92180: Uncontrolled Search Path Element

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PDF Architect. An attacker must first obtain the ability to...

PT-2026-92195

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PDF Architect. An attacker must first obtain the ability to...

CVE-2026-91846: Missing Authorization

Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access the referenced object. The commit explains that collection elements themselves only store UUIDs, while the collection view later resolves...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf, sockmap: Fixed a race condition between element replacement and close. The element replacement with a socket that is different from the one stored may race with the close operation, where the link of the socket is popped...