Information Exposure

dompdf/dompdf is vulnerable to Information Exposure. The vulnerability is due to insufficient validation of data-URI embedded SVG elements, which allows an attacker to reference local files through the href or xlink:href attributes and exploit differences in file processing behavior to leak...

Path Traversal

dompdf/dompdf is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths when processing SVG images embedded through data: URIs, where the second SVG processing pass performed by php-svg-lib does not enforce the same security restrictions, allowing an...

SUSE CVE-2026-64420

In the Linux kernel, the following vulnerability has been resolved: mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because the drvdata was already set, sub-drivers like crosectypec can still...

EUVD-2026-48964

In the Linux kernel, the following vulnerability has been resolved: mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because the drvdata was already set, sub-drivers like crosectypec can still...

CVE-2026-64420

In the Linux kernel, the following vulnerability has been resolved: mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because the drvdata was already set, sub-drivers like crosectypec can still...

[SECURITY] Fedora 43 Update: mbedtls-3.6.7-1.fc43

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

PT-2026-64641

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel within the cros ec multi-function device mfd component. If the ec device probe function fails, the cros ec class release function releas...

openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21433-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21433-1 advisory. Changes in hauler: - update embedded dependency x/net to 0.57 to fix CVE-2026-39821 bsc1266602 Tenable has extracted the preceding description block...

EUVD-2026-48249

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6...

CVE-2026-61945 WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6...

CVE-2026-65490: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0...

The vulnerability of the ina2xx_probe() function in the drivers/iio/adc/ina2xx-adc.c file of various types of embedded sensors in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the ina2xxprobe function in the drivers/iio/adc/ina2xx-adc.c file of various types of embedded sensors in the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

GHSA-J8QW-6JW8-R297 Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem

Summary If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document. Details Using an element inside a data-URI...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the processing of embedded SVG images containing elements with xlink:href attributes referencing local files or directories. An attacker can determine the existence of files or directories on the server by...

CVE-2026-56416

In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dnamevaliddatstart, ...' and passes it straight to 'querydnametolower'...

EUVD-2026-47656

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-8152

CVE-2026-8152 affects Unblu Spark. The issue is an open redirect that can be escalated to a DOM-based XSS when deployed with com.unblu.identifier.siteEmbeddedSetup=true, causing injected JavaScript to run in the host app’s origin and gain access to cookies, DOM, and same-origin APIs. This expands...

CVE-2026-8152 Unblu Spark Open Redirect leading to DOM-Based XSS

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-8152 Unblu Spark Open Redirect leading to DOM-Based XSS

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...

CVE-2026-8152

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...