kernel: Fix of 8 CVEs

rtmutex: Use waiter::task instead of current in removewaiter CVE-2026-43499 - xfs: fix freemap adjustments when adding xattrs to leaf blocks CVE-2026-43158 - xfs: delete attr leaf freemap entries when empty CVE-2026-43158 - ALSA: 6fire: fix use-after-free on disconnect CVE-2026-31581 - brcmfmac:...

CVE-2026-15072

creationtimestamp| type| source ---|---|--- 2026-07-11 04:40:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdtveuinl2s 2026-07-13 23:53:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkv7yxode2y 2026-07-16 08:13:23+00:00| seen|...

CVE-2026-15295

creationtimestamp| type| source ---|---|--- 2026-07-11 02:05:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdl6ox3n72d 2026-07-13 23:14:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkt2is57h2z 2026-07-16 08:12:13+00:00| seen|...

CVE-2026-59217

creationtimestamp| type| source ---|---|--- 2026-07-11 00:34:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg4fw5q22i...

EUVD-2026-43078

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4...

CVE-2026-55672

creationtimestamp| type| source ---|---|--- 2026-07-11 00:19:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfbfdqjr2i...

CVE-2026-55883

creationtimestamp| type| source ---|---|--- 2026-07-11 00:18:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqdfagtiqy2i 2026-07-11 03:34:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdq7ecayc2y...

CVE-2026-15375

creationtimestamp| type| source ---|---|--- 2026-07-11 00:13:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdexrohb62w...

CVE-2026-12761

creationtimestamp| type| source ---|---|--- 2026-07-10 23:18:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqdbtyyx3625 2026-07-11 00:00:37+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqde7tbdel22 2026-07-11 14:00:30+00:00| seen|...

GHSA-H4G2-XFMW-Q2C9

creationtimestamp| type| source ---|---|--- 2026-07-10 23:12:24+00:00| seen| https://gist.github.com/alon710/5e2741edb2d79f8c7e4e9d0fb2942745 2026-07-11 00:01:00+00:00| seen| https://gist.github.com/alon710/5e2741edb2d79f8c7e4e9d0fb2942745...

CVE-2026-55669

creationtimestamp| type| source ---|---|--- 2026-07-10 23:00:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdatvtvhq26...

CVE-2026-55641

creationtimestamp| type| source ---|---|--- 2026-07-10 22:59:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdaswkwrv2y 2026-07-11 19:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqfdwxlrnz25 2026-08-28 20:35:18+00:00|...

CVE-2026-8609

creationtimestamp| type| source ---|---|--- 2026-07-10 22:20:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd6nqxkrk2x 2026-07-11 00:17:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdf5lhe6f2e...

CVE-2026-15083

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4...

CVE-2026-15083 ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.0.12, from 3.1.0 to 3.1.4...

CVE-2026-15083

Summary: CVE-2026-15083 affects the Drupal ECA: Event - Condition - Action (ECA) module. The issue is an unitary vulnerability where an Improperly Controlled Modification of Dynamically-Determined Object Attributes can lead to Object Injection. Affected versions: ECA: Event - Condition - Action i...

CVE-2026-13039

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform a...

CVE-2026-55879

OpenReplay (self-hosted) versions 1.24.0–1.24.x are affected by an unauthenticated stored XSS in the tracking SDK. The SDK accepts custom event names and captured page URLs from any visitor using a public project key and stores data in ClickHouse without output encoding. When rendered in the auth...

CVE-2026-55472

creationtimestamp| type| source ---|---|--- 2026-07-10 20:10:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcxdteayy2z 2026-07-11 01:02:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhp6pnjy2y 2026-07-14 04:11:02+00:00| seen|...

SiYuan: Stored XSS in Bazaar marketplace via package README event handlers

Summary renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only attribute names present in a fixed eventAttrs map copied from the w3schoo...