CVE-2026-48813

A flaw was found in Flawfinder. An improper input neutralization issue leads to output manipulation, specifically, terminal/ANSI escape sequence injection and XML injection. A malicious filename can inject arbitrary content in the terminal output and improperly sanitized fields such as filenames,...

Duplicate Advisory: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6mcf-g667-w3qv. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter...

UBUNTU-CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73490

CVE-2026-73490 affects Loofah (HTML5 sanitizer) prior to version 2.25.2. The root cause is that the local-reference restriction was applied only to the xlink:href attribute on SVG use and feImage elements, while the plain href attribute was not restricted. As a result, a crafted sanitized SVG cou...

CVE-2026-73490 Loofah: SVG `href` attribute bypasses local-reference restriction

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73490 Loofah: SVG `href` attribute bypasses local-reference restriction

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

EUVD-2026-57514

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...

CVE-2026-49466 Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...

CVE-2026-49466

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...

CVE-2026-49466 Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Template Attributes

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting XSS in the drafts shortcode and Draft List widget when the documented custom template option places the draft placeholder inside an HTML attribute. Th...

CVE-2026-72806 SiYuan before v3.7.4 Authentication Bypass via Attribute View

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including...

RLSA-2026:53846 Important: isns-utils security update

The iSNS package contains the daemon and tools to setup a iSNS server, and iSNS client tools. The Internet Storage Name Service iSNS protocol allows automated discovery, management and configuration of iSCSI and Fibre Channel devices using iFCP gateways on a TCP/IP network. Security Fixes:...

CVE-2026-15249

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

RLSA-2026:53847 Important: isns-utils security update

The iSNS package contains the daemon and tools to setup a iSNS server, and iSNS client tools. The Internet Storage Name Service iSNS protocol allows automated discovery, management and configuration of iSCSI and Fibre Channel devices using iFCP gateways on a TCP/IP network. Security Fixes:...

isns-utils security update

An update is available for isns-utils. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The iSNS package contains the daemon and tools to setup a iSNS server, and...

isns-utils security update

An update is available for isns-utils. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The iSNS package contains the daemon and tools to setup a iSNS server, and...

CVE-2026-15249

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

CVE-2026-15249 Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

RHEL 9 : isns-utils (RHSA-2026:53847)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:53847 advisory. The iSNS package contains the daemon and tools to setup a iSNS server, and iSNS client tools. The Internet Storage Name Service iSNS protocol allows...