kernel: netfilter: nf_tables: don't skip expired elements during walk

A flaw was found in the Linux kernel. Improper management of the lifecycle of some nftables objects could result in consumption of all system memory. An attacker who can create nftables rules could use this to effect a Denial of Service...

xmldom: Quadratic-memory consumption

Summary When an element declares a namespace prefix, xmldom copies the entire in-scope namespace map into a fresh object and keeps that copy on the element while it is open on the parse stack. A crafted document that nests N elements, each declaring one unique prefix, therefore drives the parser ...

EUVD-2026-69236

xmldom: Quadratic-memory consumption...

CVE-2026-84818

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

BIT-JENKINS-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84818 WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

EUVD-2026-72647

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

CVE-2026-84818 WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

CVE-2026-84818

CVE-2026-84818 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting the WordPress Open User Map plugin in versions 1.4.50 and below . The vulnerability is rated HIGH with a CVSS 3.1 score of 7.1 (vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), assigned by Patchstack . The attack...

PT-2026-88172

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84818: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

PT-2026-86993

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by care in WordPress Plugin Open User Map versions = 1.4.50...

PT-2026-93252

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=557283672 Crash type: UNKNOWN READ Crash state: renumber by map renumber by map disable noname group capture...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073363)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073363 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed t...

SUSE CVE-2026-67437

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...

DEBIAN-CVE-2026-57159

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

CVE-2026-57159

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assignptandupdatemap in pjmedia/src/pjmedia/sdpneg.c uses...

CVE-2026-80883

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1xclientregister function is called just prior to register map initialization loop, making the device available to userspace. This m...

AZL-99437 CVE-2026-80883 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1xclientregister function is called just prior to register map initialization loop, making the device available to userspace. This m...