EUVD-2026-60592

Grav: detectXss misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS...

Security Bulletin: Vulnerability in jackson-databind affects DB2 Dev Extension (CVE-2026-59888, CVE-2026-59889)

Summary Upgraded jackson-databind to 2.21.5 to remediate CVE-2026-59888 Improperly Controlled Modification of Dynamically-Determined Object Attributes and CVE-2026-59889 Incorrect Authorization — CVSS Base Score 6.5 Medium — PVR0820325. Vulnerability Details CVEID:CVE-2026-59888 DESCRIPTION:...

GHSA-269C-H76Q-8CXW Grav: Stored XSS via quoted-attribute bypass in detectXss

Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...

Grav: Stored XSS via quoted-attribute bypass in detectXss

Summary A page editor without admin.super can place an event handler after a inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it. Details Security::detectXss system/src/Grav/Common/Security.php:253 anchors the...

EUVD-2026-58646

Grav: Stored XSS via quoted-attribute bypass in detectXss...

CVE-2026-90118

CVE-2026-90118 is an off-by-one page overflow in the Linux kernel's NTFS filesystem driver, specifically in ntfs_decompress(). The per-token range check tests dp_addr > dp_sb_end instead of dp_addr >= dp_sb_end, allowing one byte to be written past the destination page. Because NTFS_SB_SIZE...

EUVD-2026-81711

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-90118 ntfs: fix off-by-one page overflow in ntfs_decompress()

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix off-by-one page overflow in ntfsdecompress The per-token range check in ntfsdecompress uses if cb = cbsbend || dpaddr dpsbend break; so dpaddr == dpsbend falls through to the symbol copy dpaddr++ = cb++, writing one byt...

CVE-2026-92987

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

CVE-2026-76781 Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a...

CVE-2026-76781 Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing and causing a...

CVE-2026-92987 roxmltree through 0.21.1 Denial of Service via Quadratic Parsing

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

CVE-2026-92987

roxmltree (a Rust XML parsing library) versions through 0.21.1 are susceptible to a denial-of-service vulnerability caused by quadratic-time attribute and namespace validation during XML parsing, with no imposed limit on attribute count. An attacker can craft an XML document containing tens of th...

CVE-2026-92987 roxmltree through 0.21.1 Denial of Service via Quadratic Parsing

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

CVE-2026-91011: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

Siemens Teamcenter 2412.x < 2412.0013 / 2506.x < 2506.0010 / 2512.x < 2512.2607 / 2606.x < 2606.2607 XSS (SSA-157465)

The version of Siemens Teamcenter installed on the remote host is 2412.x prior to 2412.0013, or 2506.x prior to 2506.0010, or 2512.x prior to 2512.2607, or 2606.x prior to 2606.2607. It is, therefore, affected by a reflected cross-site scripting vulnerability. Affected applications do not properl...

CVE-2026-92987: Inefficient Algorithmic Complexity

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

Improper Handling of Unicode Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the attribute truncation process. An attacker can cause the retention of attribute values exceeding the configured length limit by supplying specially crafted Unicode replacement characters,...

CVE-2026-61597

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it...

CVE-2026-61588 djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django Model instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as...