CVE-2026-24930

UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

SUSE CVE-2026-23645

SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting XSS vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file e.g., imported from an...

RockyLinux 9 : freerdp (RLSA-2026:2048)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:2048 advisory. freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. CVE-2026-23530 freerdp: FreeRDP...

CVE-2026-25642

CVE-2026-25642 affects HedgeDoc; prior to version 1.10.6, the security policy for files served under /uploads/ was insufficient, resulting in a too open Content-Security-Policy and enabling hosting of malicious interactive content (e.g., fake login forms) via SVG files. The issue is fixed in 1.10...

EUVD-2026-5588

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more strict security-policy. This resulted in a too open Content-Security-Policy and furthermore opened the possibility to host malicious...

CVE-2026-25642

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.6, files served below the /uploads/ endpoint did not use a more strict security-policy. This resulted in a too open Content-Security-Policy and furthermore opened the possibility to host malicious...

EUVD-2026-5618

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would...

CVE-2026-22254 Winter Affected by Stored Cross-Site Scripting (XSS) in Asset Manager

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Versions of Winter CMS before 1.2.10 allow users with access to the CMS Asset Manager were able to upload SVGs without automatic sanitization. To actively exploit this security issue, an attacker would...

CVE-2026-24930

UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24929

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24930

UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24929

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24930

UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

EUVD-2026-5669

UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24930

UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24930

UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24930

CVE-2026-24930 is a use-after-free (UAF) concurrency vulnerability in the graphics module that may affect system availability. Documented impact: availability; attack vector is local with low complexity and no user interaction required. Affected versions are described as prior to 2026; PT-2026-67...

CVE-2026-24929

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

EUVD-2026-5667

Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-24929

CVE-2026-24929 is described as an out-of-bounds read in the graphics module. The available sources (NVD/Red Hat/CVE listing and related trackers) reiterate the same description and indicate the impact may affect availability. The CVSS 3.1 vector shows: Local attack vector (AV:L), Low attack compl...