PT-2026-88823

Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory...

PT-2026-88811

An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate decrypt into and Chacha20.authenticate decrypt into functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns...

Kibana 7.x / 8.x < 8.19.16 / 9.0.x < 9.3.5 / 9.4.x < 9.4.2 Path Traversal (ESA-2026-160)

The version of Kibana installed on the remote host is 7.11.0 through 7.17.29, or 8.x prior to 8.19.16, or 9.0.x prior to 9.3.5, or 9.4.x prior to 9.4.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-160 advisory. - Improper Limitation of a Pathname to a Restricted...

Debian dla-4778 : python-pyasn1-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4778 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4778-1 [email protected]...

CVE-2026-87055

A flaw was found in operator-sdk-builder. The software uses a flexible label, called a mutable tag, to identify its base container image instead of a unique, fixed identifier. This practice allows the underlying base image to change unexpectedly between builds. Such a change could introduce...

NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

EUVD-2026-69225

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content...

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

Summary xmldom's parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. . The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name an...

GHSA-6H8R-XR42-GP59 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

Summary xmldom's parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. . The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name an...

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Summary On the @xmldom/xmldom 0.8.x line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking ReDoS, so a single small crafted end tag stalls the Node.js event loop. It is reachable...

GHSA-X4FP-J954-R2F4 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Summary On the @xmldom/xmldom 0.8.x line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking ReDoS, so a single small crafted end tag stalls the Node.js event loop. It is reachable...

Improper Input Validation

Micrometer is vulnerable to improper input validation. The vulnerability is due to the use of untrusted, non-normalized input for metric names, tag keys, and tag values, which allows an attacker to supply malicious or unexpected metrics data and potentially cause security or operational issues in...

PT-2026-89357

Name of the Vulnerable Software and Affected Versions Vim affected versions not specified Description Vim incorrectly handles certain tags files, which could allow an attacker to execute arbitrary code. Recommendations At the moment, there is no information about a newer version that contains a f...

CVE-2026-12853

The Flamingo plugin for WordPress (versions up to and including 2.6.2 ) is vulnerable to an authorization bypass. The plugin's flamingo_map_meta_cap() filter restricts access to its admin UI but does not extend to WordPress core APIs, specifically XML-RPC wp.getTerms and admin-ajax ajax-tag-searc...

CVE-2026-12853 Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-12853: Missing Authorization

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

Exploit for CVE-2026-57062

gpgsm CVE-2026-57062: CMS AES-GCM short tag USN-8720-1 GnuP...

SUSE CVE-2026-80832

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffer underallocation The AAD buffer allocated in qceaeadccmpreparebufassoclen can be smaller than the length later programmed into the DMA scatterlist. The allocation size is currently calculated as:...

CVE-2026-52771: Improper Neutralization of Special Elements used in an SQL Command

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage interpolates a page tag retrieved from the database into a DELETE FROM …links WHERE totag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/tag A...

Linux Distros Unpatched Vulnerability : CVE-2026-84989

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature...