CVE-2026-73253

Mongoose (embedded web server and network library) prior to version 7.22 is vulnerable to a TLS hostname verification bypass . The root cause is in mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() (in src/tls_builtin.c), which call mg_match() — a function whose wildcard matching can cross DNS...

resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

A flaw was found in the resolv gem. This vulnerability arises from the incorrect handling of DNS label lengths during message encoding. A remote attacker could exploit this by providing a specially crafted hostname to an application utilizing the resolv gem. This could lead to the bypass of...

PT-2026-79100

Name of the Vulnerable Software and Affected Versions Lighthouse affected versions not specified Description A flaw allows a remote attacker who has compromised a spoke cluster to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters. This occurs because the...

JetBrains YouTrack < 2026.2.18068 Stored XSS (CVE-2026-75048)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18068. It is, therefore, affected by a stored cross-site scripting vulnerability: - Stored XSS via the fenced code-block language label was possible. CVE-2026-75048 Note that Nessus has not tested for this issue but...

PT-2026-79077

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg tls verify cert san and mg tls verify cert cn functions in...

CVE-2026-75917

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...

EUVD-2026-62442

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...

CVE-2026-75917 SiYuan before v3.7.4 XSS-to-RCE via pathName.ts

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...

CVE-2026-75917

SiYuan before v3.7.4 contains an XSS-to-RCE vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()). Document metadata fields (bookmark, alias, memo, alternate name) are concatenated into the aria-label HTML attribute without escaping, a...

GHSA-F2FF-P2WW-7P4P vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, openstack-keystone-2025.2, openstack-nova-2026.1, dbt-bigquery, openstack-horizon-2026.1-fips, openstack-glance-2026.1-fips, openstack-placement-2026.1-fips, openstack-glance-2025.2, openstack-nova-2025.2, openstack-horizon-2025.1, mlflow-fips...

PT-2026-78383

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An issue exists in the file-tree picker's hover-tooltip generation within the getLeaf and movePathTo functions located in app/src/util/pathName.ts used by the 'move/link to' path-selection dialogs...

CVE-2026-52854

The MediaWiki Maps extension (versions before 12.1.3) is vulnerable to stored XSS: the display_map parser function's overlays parameter passes unescaped overlay names to Leaflet's layer-control label code, enabling script execution in any viewer's browser. A PoC exists using {{#display_map:0,0|se...

Linux Distros Unpatched Vulnerability : CVE-2026-72154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openrisc: Fix jumplabel smp syncing The original commit 8c30b0018f9d openrisc: Add jump label support copies from arm64 and does not properly consider how icach...

ANT-2026-GSPVGEYA · gpg/libgcrypt · Stack Buffer Overflow

stack-buffer-overflow medium CVE-2026-41990 GHSA-78pv-qq8x-94px Severity Claude high · Security research firm - · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-GSPVGEYA: ML-DSA...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

EUVD-2026-60247

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75048: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...