dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

DRUPAL-CONTRIB-2026-168

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view...

Security Bulletin: Resolved XSS vulnerability in DOMPurify (CVE-2026-75838)

Summary Carbon Charts has updated its DOMPurify dependency from ^3.4.12 to ^3.4.14, resolving CVE-2026-75838 Medium, CVSS 5.4 — an XSS vulnerability caused by improper INPLACE sanitization in DOMPurify versions prior to 3.4.13. The vulnerability affects the sanitize API used internally by Carbon...

Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view...

PT-2026-97665

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently validate requested filenames when serving generated submission exports. Under certain configurations, a user with permission to view...

The vulnerability of the .NET software platform and the Visual Studio Code code editor, related to improper deletion of critical data at the boundary, allows attackers to disclose sensitive information.

The vulnerability of the .NET software platform and the code editor Visual Studio Code is related to improper boundary removal of critical data. Exploiting this vulnerability can allow an attacker to disclose protected information remotely...

[SECURITY] Fedora 45 Update: mat2-0.14.0-7.fc45

Metadata consist of information that characterizes data. Metadata are used to provide documentation for data products. In essence, metadata answer who, what, when, where, why, and how about every facet of the data that are being documented. Metadata within a file can tell a lot about you. Cameras...

CVE-2026-58271

Sync-in Server , an open-source platform for file storage and collaboration, is vulnerable to TOTP brute-force in versions prior to 2.4.0 . The endpoint POST /api/app/sync/register fails to increment the passwordAttempts counter on TOTP failure due to a freeze branch in updateAccesses(), so the l...

CVE-2026-58271 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...

CVE-2026-58271 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...

CVE-2026-58271: Improper Restriction of Excessive Authentication Attempts

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, SyncClientsManager.register calls updateAccessesuser, ip,...

Zimbra Collaboration - Unrestricted File Upload

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

CVE-2026-93765

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field...

Linux Distros Unpatched Vulnerability : CVE-2026-90127

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtio: rtc: time out alarm requests RTC class operations run with rtcdevice.opslock held. The virtio RTC alarm requests currently wait without a timeout for th...

Linux Distros Unpatched Vulnerability : CVE-2026-93050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still...

remove-ai-watermarks v0.41.1

Remove AI Watermarks Remove AI provenance marks from images and video you generated yourself: known visible labels such as the Google Gemini sparkle watermark and vendor text marks; invisible pixel watermarks through direct local-format disruption or diffusion regeneration; C2PA, EXIF, XMP, IPTC,...

DEBIAN-CVE-2026-93169

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmpdma: fix race between runtime PM and device removal In zynqmpdmaremove, runtime PM was disabled only after checking state and doing a manual suspend. This can race with runtime PM in the remove/unbind rmmod path...

AZL-102279 CVE-2026-93117 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs are only guaranteed to be valid when usbdynidslock is held, as removeidstore can free the node. Thus, make a copy in usbprobeinterface. Clarify the documentati...

AZL-102099 CVE-2026-93103 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Preserve unit 0 on allocation failure hfi1freedevdata assumes that the device was inserted into the unit table and unconditionally erases dd-unit. If xaallocirq fails, the zero-initialized unit remains zero, so full...

DEBIAN-CVE-2026-93103

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Preserve unit 0 on allocation failure hfi1freedevdata assumes that the device was inserted into the unit table and unconditionally erases dd-unit. If xaallocirq fails, the zero-initialized unit remains zero, so full...