CVE-2026-53363

CVE-2026-53363 (Linux kernel xfrm/iptfs): The vulnerability arises because iptfs_consume_frags() does not propagate the SKBFL_SHARED_FRAG flag when transferring paged fragments, mirroring the flaw fixed in skb_try_coalesce() for CVE-2026-46300. As a result, ESP could make incorrect in-place encry...

CVE-2026-53363

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfsconsumefrags iptfsconsumefrags transfers paged fragments from one socket buffer to another but fails to propagate the SKBFLSHAREDFRAG flag. This is the same class of bug that was...

EulerOS 2.0 SP12 : sed (EulerOS-SA-2026-2568)

According to the versions of the sed packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic filesystem operatio...

EulerOS 2.0 SP12 : sed (EulerOS-SA-2026-2628)

According to the versions of the sed packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic filesystem operatio...

Improper Neutralization Of Template Expressions

DOMPurify is vulnerable to improper neutralization of template expressions. The vulnerability is due to improper sanitization when both SAFEFORTEMPLATES: true and RETURNDOM: true or INPLACE: true are enabled, which allows an attacker to inject template expressions e.g., $evil, evil, or that remai...

kernel: crypto: algif_aead - Revert to operating out-of-place

A flaw was found in the Linux kernel's algifaead cryptographic algorithm interface. An incorrect in-place operation causes source and destination data mappings to differ during cryptographic processing. A low-privileged local attacker can exploit this flaw to corrupt the contents of sensitive...

EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2026-2429)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : xfrm: esp: avoid in-place decrypt on shared skb fragsCVE-2026-43284 crypto: algifaead - Revert to operating...

USN-8440-1: Linux kernel (Azure) vulnerabilities

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcod...

USN-8440-1 linux-azure-6.8 vulnerabilities

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcod...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the SAFEFORTEMPLATES function. An attacker can inject template expressions that survive sanitization inside element content by splitting malicio...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the SAFEFORTEMPLATES function. An attacker can inject template expressions that survive sanitization inside element content by...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the INPLACE function when handling a element containing an element with an attached shadow DOM. An attacker can execute arbitrar...

NPM: DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

NPM: DOMPurify INPLACE Sanitization Bypass via Attached Shadow Root Inside .content vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.6...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the INPLACE function when handling a element containing an element with an attached shadow DOM. An attacker can execute arbitrary scripts in the...

NPM: DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

NPM: DOMPurify: INPLACE mode trusts attacker-controlled nodeName on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.6...

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the INPLACE process when attacker-controlled live DOM nodes are sanitized. An attacker can execute arbitrary scripts in the context of the...

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

Summary When DOMPurify.sanitizeroot, INPLACE: true is called on an attacker-supplied live DOM node, DOMPurify still trusts currentNode.nodeName for non-form nodes in the main sanitizeElements pipeline. A real child node whose observable nodeName is attacker-controlled can therefore be misclassifi...

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the INPLACE process when attacker-controlled live DOM nodes are sanitized. An attacker can execute arbitrary scripts in the...

GHSA-X4VX-RJVF-J5P4 DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

Summary When DOMPurify.sanitizeroot, INPLACE: true is called on an attacker-supplied live DOM node, DOMPurify still trusts currentNode.nodeName for non-form nodes in the main sanitizeElements pipeline. A real child node whose observable nodeName is attacker-controlled can therefore be misclassifi...

NPM: DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

NPM: DOMPurify: Cross-realm INPLACE sanitization leaves executable markup intact via realm-bound instanceof checks vulnerability discovered by ? in WordPress Npm dompurify versions = 3.4.5...