CVE-2026-96879 "Checked by" label in page history should not be shown if the underlying review log entry is suppressed"

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0...

CVE-2026-96879 "Checked by" label in page history should not be shown if the underlying review log entry is suppressed"

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

CVE-2026-98018 net: mctp: i3c: serialize probe with bus removal

In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctpi3cprobe drops busdevslock after finding the matching bus. A concurrent I3CNOTIFYBUSREMOVE can then unregister and free the bus netdev before probe passes its private data to...

CVE-2026-98018

In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctpi3cprobe drops busdevslock after finding the matching bus. A concurrent I3CNOTIFYBUSREMOVE can then unregister and free the bus netdev before probe passes its private data to...

CVE-2026-96879: Improper Removal of Sensitive Information Before Storage or Transfer

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0...

AZL-103847 CVE-2026-97479 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when removing a device while its supplier is unbinding During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 devicelinksnodriver+0xcc/0xfc ... Cal...

CVE-2026-97479

In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when removing a device while its supplier is unbinding During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 devicelinksnodriver+0xcc/0xfc ... Cal...

UBUNTU-CVE-2026-97479

In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when removing a device while its supplier is unbinding During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 devicelinksnodriver+0xcc/0xfc ... Cal...

CVE-2026-97479 driver core: Avoid warning when removing a device while its supplier is unbinding

In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when removing a device while its supplier is unbinding During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 devicelinksnodriver+0xcc/0xfc ... Cal...

CVE-2026-97411 net: ibm: emac: mal: fix potential system hang in mal_remove()

In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: mal: fix potential system hang in malremove napidisable is not idempotent and calling it on an already-disabled or unenabled NAPI context will cause the kernel to spin indefinitely waiting for the NAPISTATESCHED b...

CVE-2026-93822

The Linux kernel contains a vulnerability where failing to hold the pci_rescan_remove_lock while stopping and removing a root bus can cause a race condition. This race occurs during concurrent rescan or hotplug operations triggered via sysfs . The flaw may lead to use-after-free issues or system ...

DEBIAN-CVE-2026-73064

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers...

AZL-105705 CVE-2026-73064 affecting package qemu 10.1.0-1

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers...

CVE-2026-73064

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers...

CVE-2026-73064

The Mbed TLS library (versions 3.2.0 through 3.6.6 and 4.0.0 through 4.1.0 ) is vulnerable to a flaw where a failure in the entropy source allows an attacker to remove or inject bytes into the start of a TLS stream. This issue specifically impacts TLS 1.3 servers . The root cause is linked to a r...

CVE-2026-73064

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers...

CVE-2026-93276: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator devmregulatorgetexclusive initialises the regulator with enablecount = 1, requiring the consumer to disable it before release. The devm...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...