CVE-2026-58263 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/ carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

A flaw was found in the Linux kernel's RDMA/mlx4 component. This vulnerability arises from the incorrect use of Read-Copy Update RCU in the mlx4srqevent function. An attacker could potentially trigger an event before the srq object is fully initialized, leading to a system crash. This could resul...

CVE-2026-24248

creationtimestamp| type| source ---|---|--- 2026-07-01 16:35:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplx6mxczo2p 2026-07-02 04:34:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7downsd2l...

CVE-2026-24245

creationtimestamp| type| source ---|---|--- 2026-07-01 16:21:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplwf2i7xe26 2026-07-02 04:27:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn6woaywm2k...

CVE-2026-7532

creationtimestamp| type| source ---|---|--- 2026-07-01 16:00:17+00:00| seen| https://infosec.place/objects/c22b899e-0722-43cb-ba3c-e0f141edd0ce...

CVE-2026-45292

creationtimestamp| type| source ---|---|--- 2026-07-01 15:16:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplspxj3ro22 2026-08-25 12:45:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtvtwiw3pf26...

CVE-2026-12904

creationtimestamp| type| source ---|---|--- 2026-07-01 12:45:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplkdanlsf24 2026-07-06 00:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpwsr5544s2r 2026-07-06 00:16:08+00:00| seen|...

CVE-2026-20461

creationtimestamp| type| source ---|---|--- 2026-07-01 12:44:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplkanecxd2l 2026-07-02 06:10:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpneoflxez2y 2026-07-07 16:45:03+00:00| seen|...

CVE-2026-20457

creationtimestamp| type| source ---|---|--- 2026-07-01 12:40:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplk23bz3w23 2026-07-02 06:21:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnfc7ovxy2i 2026-07-07 16:45:07+00:00| seen|...

CVE-2026-12142

creationtimestamp| type| source ---|---|--- 2026-07-01 11:43:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplgtdm64l2h 2026-07-01 12:25:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplj77f5xq2y 2026-07-01 15:26:40+00:00| seen|...

kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

A flaw was found in the Linux kernel's RDMA/mlx4 component. This vulnerability arises from the incorrect use of Read-Copy Update RCU in the mlx4srqevent function. An attacker could potentially trigger an event before the srq object is fully initialized, leading to a system crash. This could resul...

kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

A flaw was found in the Linux kernel's RDMA/mlx4 component. This vulnerability arises from the incorrect use of Read-Copy Update RCU in the mlx4srqevent function. An attacker could potentially trigger an event before the srq object is fully initialized, leading to a system crash. This could resul...

CVE-2026-2387

The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eoevents' shortcode accepting attacker-controlled 'noevents' content and rendering it in event list templates without output escaping. This makes...

CVE-2026-2387

The CVE-2026-2387 entry concerns the WordPress Event Organiser plugin (versions up to and including 3.12.9). The vulnerability is a Stored Cross-Site Scripting flaw in the eo_events shortcode: attacker-controlled no_events content is rendered in event list templates without output escaping, allow...

CVE-2026-2387 Event Organiser <= 3.12.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode

The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eoevents' shortcode accepting attacker-controlled 'noevents' content and rendering it in event list templates without output escaping. This makes...

EUVD-2026-40904

The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eoevents' shortcode accepting attacker-controlled 'noevents' content and rendering it in event list templates without output escaping. This makes...

CVE-2026-2387

The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eoevents' shortcode accepting attacker-controlled 'noevents' content and rendering it in event list templates without output escaping. This makes...

CVE-2026-55407

creationtimestamp| type| source ---|---|--- 2026-07-01 04:02:06+00:00| seen| https://bsky.app/profile/hn100.bsky.social/post/3mpkn2lmjov2g 2026-07-01 10:01:59+00:00| seen| https://bsky.app/profile/blackhatnews.tokyo/post/3mplb65dijk2b 2026-07-01 14:03:15+00:00| seen|...

SUSE CVE-2026-53072

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hciconnrequestevt with HCIPROTODEFER When protocol sets HCIPROTODEFER, hciconnrequestevt calls hciconnectcfmconn without hdev-lock. Generally hciconnectcfm assumes it is held, and if conn is deleted...