CVE-2026-73491 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

CVE-2026-73491 Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.alloweduri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character...

EUVD-2026-57626

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

GHSA-X692-Q9X7-8C3F

creationtimestamp| type| source ---|---|--- 2026-08-12 19:00:03+00:00| seen| https://t.me/GithubRedTeam/97769 2026-08-13 00:00:06+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97769 2026-08-15 08:00:06+00:00| seen| Telegram/9qYdJNeZ50siptVHrqc-g91N4K0CPGozDwGl0Etd8sr4-fM 2026-08-1...

CVE-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

EUVD-2026-57223

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events SSE streams through the /pubsub/subscribe/ endpoint. The tokenrequired decorator used by the Pub/Sub interface authenticated requests solely by matching the...

CVE-2026-73374

CVE-2026-73374 describes a stored XSS in Vulnerability-Lookup’s render_tag_badges Jinja filter. Values from containers.cna.references[].tags[] were interpolated into HTML badge markup and wrapped with MarkupSafe.Markup, bypassing Jinja escaping. An authenticated user with vulnerability:create/mod...

CVE-2026-13177

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

Linux Distros Unpatched Vulnerability : CVE-2026-68256

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: detectlinkandlocalsink: DP alt mode timeout path leaks prevsink reference prevsink is unconditionally retained via dcsinkretain at function...

Linux Distros Unpatched Vulnerability : CVE-2026-68232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/gpusvm: Fix MM reference leak in drmgpusvmrangeevict If kvmallocarray fails in drmgpusvmrangeevict, the MM reference acquired earlier is not released,...

Linux Distros Unpatched Vulnerability : CVE-2026-68341

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovpn: fix use after free in unlockovpn unlockovpn iterates over the releaselist using llistforeachentry and drops the peer reference inside the loop body via...

CVE-2026-68122

A flaw was found in the Linux kernel's ovpn module. A race condition in the TCP error handling paths can lead to a reference count leak. This occurs when an internal object's reference count is incremented twice but decremented only once, preventing the object from being properly released. Over...

CVE-2026-68205

A flaw was found in the Linux kernel. The v4l2-fwnode module, responsible for video device node management, incorrectly handles module ownership during asynchronous subdevice registration. This can lead to a sensor module's reference count not being properly incremented. As a result, the module m...

CVE-2026-68180

A flaw was found in the intelth Intel Trace Hub driver within the Linux kernel. This vulnerability occurs because the intelthoutputopen function acquires a device reference that is not properly released by the intelthmscrelease function when handling Message Signaled Interrupt MSC outputs...

CVE-2026-68232

A flaw was found in the Linux kernel's drm/gpusvm component. When the kvmallocarray function fails within drmgpusvmrangeevict, a previously acquired memory management MM reference is not properly released. This oversight leads to a reference leak, which can result in resource exhaustion and a...

CVE-2026-68397

A flaw was found in the Linux kernel's net/iucv module. The afiucvhsrcv function fails to properly manage socket references. This allows a local attacker to trigger a use-after-free vulnerability by concurrently closing a socket while it is being processed. Successful exploitation can lead to a...

CVE-2026-68371

A flaw was found in the Linux kernel's USB MUSB OMAP2430 driver. The omap2430probe function incorrectly decrements the reference count of a borrowed device node, leading to an unbalanced reference count. This issue could potentially result in a denial of service...

CVE-2026-20712

Incomplete cleanup in some UEFI firmware for some IntelR reference platforms within UEFI may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when...