RHEL 9 : perl-DBI (RHSA-2026:66179)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:66179 advisory. DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variable...

RHEL 10 : perl-DBI (RHSA-2026:65887)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:65887 advisory. DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variabl...

PT-2026-88870

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2026-88885

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output...

PT-2026-88949

SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft malicious template paths that break out of the attribute context and execute JavaScript when a victim opens notebook configuration, enabling...

CVE-2026-17149: Improper Neutralization of Input During Web Page Generation

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute in all versions up to, and including, 3.2.4 due to insufficient input sanitization and output...

CVE-2026-77186: Improper Neutralization of Input During Web Page Generation

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

PT-2026-88798

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: Incomplete fix for...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: wget (UTSA-2026-106776)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106776 advisory. GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in src/convert.c that allows a remote...

Regular Expression Denial of Service (ReDoS)

Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Pandoc-style parseAttributes helper in packages/core/src/utilities/markdown/attributeUtils.ts and the shortcode attribute parser in...

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy ke...

GHSA-8344-3JMQ-59R6 xmldom: Quadratic-time attribute deduplication

Summary xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap. Each insertion first performs a linear scan of all already-inserted attributes to enforce the DOM uniqueness rule no two attributes with the same qualified name /...

NPM: xmldom: Quadratic-time attribute deduplication

NPM: xmldom: Quadratic-time attribute deduplication vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

xmldom: Quadratic-time attribute deduplication

Summary xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap. Each insertion first performs a linear scan of all already-inserted attributes to enforce the DOM uniqueness rule no two attributes with the same qualified name /...

EUVD-2026-70734

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize via Live NamedNodeMap Removal Skip...

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

Impact DOM.sanitize in src/util/dom.ts iterated elem.attributes a live NamedNodeMap while calling elem.removeAttribute in the same loop. Removing an attribute shifts subsequent attributes down by one index, causing the iterator to skip the adjacent attribute. An attacker can provide an HTML paylo...

EUVD-2026-69215

xmldom: Attribute name injection via setAttribute bypasses requireWellFormed...

NPM: xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

NPM: xmldom: Attribute name injection via setAttribute bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...