CVE-2026-53365

CVE-2026-53365 is a local privilege escalation vulnerability in the Linux kernel's vsock/virtio zerocopy path (net/vmw_vsock/virtio_transport_common.c). When large messages are fragmented into multiple SKBs, the zerocopy uarg is only attached to the last SKB, leaving non-final SKBs with pinned us...

CVE-2026-53365

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned user pages...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the varianturl process. An attacker can access sensitive identity-document images by obtaining and replaying signed Active Storage URLs embedded in admin review pages, without requiring authentication. This is...

MAL-2026-10287 Malicious code in backup3-ff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a32646e3ad3e35186f8344c19ccdecfd69c26e8047fc44b77c0516b644fd094 The npm package [email protected] ships multiple heavily obfuscated JavaScript bundles under assets/ AccountPage, DarkVeil, GamesPage, PlusBlockedNote...

PT-2026-57837

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11 Linux kernel versions prior to 7.1 Linux kernel versions prior to 6.7 Linux kernel versions prior to 6.18.34 Description A memory management issue exists in the net/vmw vsock/virtio transport common.c file...

PT-2026-67668

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.9 and earlier Description An issue exists in the KVM x86 component where the system fails to check for a stale page fault, specifically an invalid or obsolete root, after making MMU pages available for the shadow MMU. I...

CVE-2026-61876

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages...

EUVD-2026-43236

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages...

CVE-2026-61876 LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages...

EUVD-2026-43235

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders...

PT-2026-57560

Name of the Vulnerable Software and Affected Versions LuCI affected versions not specified Description LuCI fails to properly encode DHCPv6 lease hostnames before rendering them in status tables. This allows attackers on the same network to inject HTML markup by sending a DHCPv6 Client FQDN...

CVE-2026-12141

The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premiumtooltiptext' parameter in all versions up to, and including, 4.11.84 due to insufficient input sanitization and output escaping. This makes i...

SUSE CVE-2026-53363

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfsconsumefrags iptfsconsumefrags transfers paged fragments from one socket buffer to another but fails to propagate the SKBFLSHAREDFRAG flag. This is the same class of bug that was...

Linux Distros Unpatched Vulnerability : CVE-2026-53363

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: iptfs: preserve shared-frag marker in iptfsconsumefrags iptfsconsumefrags transfers paged fragments from one socket buffer to another but fails to propaga...

CVE-2026-55659

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's nam...

CVE-2026-41154

Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access...

CVE-2026-55659 Grist: XSS through unsafe value interpolation in server-rendered pages

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's nam...