npm: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

npm: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options regression since 14.0 vulnerability discovered by ? in WordPress npm markdown-it versions = 14.1.0, 14.3.3...

CVE-2026-111758

The markdown-it Markdown parser is vulnerable to an algorithmic-complexity denial of service (CWE-407) due to quadratic-time rendering of multi-line link reference definitions. In versions 14.1.0 to before 14.3.3 and 15.0.0 to before 15.0.3 , providing a definition where the label or title is nev...

CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

EUVD-2026-105358

markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3, a link reference definition whose label or title is never closed is On² with default options. Continuation lines are pulled lazily with str += lineContent in src/rulesblock/reference.ts, and the...

CVE-2026-80888

A flaw was found in the drm/vmwgfx component of the Linux kernel. An unprivileged client can exploit this vulnerability by passing a specially crafted file descriptor fd to the DRMVMWGBSURFACEREF or DRMVMWGBSURFACEREFEXT paths. This can lead to a dmabuf reference leak, causing resource exhaustion...

CVE-2026-98498

A flaw was found in the Linux kernel's mlx5 network driver. When handling shared connection tracking counters, the driver fails to properly release an entry's reference count if the associated counter is in the process of being released. This reference count leak prevents the reverse entry from...

CVE-2026-92539

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

CVE-2026-92539

The Grafana Enterprise instance is vulnerable to cross-organization user management manipulation when the SCIM API is enabled. Due to an insecure direct object reference , a service account with user-management permissions in one organization can read, modify, disable, or delete users belonging t...

CVE-2026-92539 Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

EUVD-2026-105187

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

CVE-2026-92539 Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

CVE-2026-113597

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder...

EUVD-2026-105163

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder...

CVE-2026-93106

A flaw was found in the Linux kernel's crashdump functionality, specifically in how it handles dm-crypt keys. When multiple dm-crypt keys are restored, a reference to the user keyring is incorrectly dropped multiple times. This can lead to a reference count underflow or a use-after-free condition...

RLSA-2026:85231 Important: jackson-databind security update

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind:...

jackson-databind security update

An update is available for jackson-databind. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The general-purpose data-binding functionality and tree-model for...

TYPO3-EXT-SA-2026-031: Insecure Direct Object Reference in extension "Analytics" (analytics)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-031...

Path Equivalence

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Path Equivalence via the serialize, normalize, and resolve functions when called with the non-default option reference: 'suffix' on a reference that has no authority. A...

CVE-2026-110725

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability to trigger cross-site scripting XSS by providing crafted input to applications that serialize or normalize relative Uniform Resource Identifiers URIs using the suffix reference option. Because the library fails to...