PT-2026-88516

Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could view that sub-block. An unauthenticated visitor could recover configuration values emitted by a restricted sub-block's asset registration —...

EulerOS 2.0 SP12 : util-linux (EulerOS-SA-2026-3392)

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition...

CVE-2026-86430

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

CVE-2026-86430

league/commonmark (a PHP Markdown parsing library) versions before 2.9.1 are affected by multiple denial-of-service vulnerabilities in three components: fenced code block detection , reference link label lookup , and emphasis delimiter processing . The root cause is super-linear work performed on...

UBUNTU-CVE-2026-68547

GHSA-jcgh-p9v3-pw6j: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files...

CVE-2026-68547

GHSA-jcgh-p9v3-pw6j: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files...

The vulnerability of the biovec_phys_mergeable() function in the block/blk.h module of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the biovecphysmergeable function in the block/blk.h module of the Linux kernel is related to an incorrect definition of its internal state. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the...

CVE-2026-86430: Inefficient Algorithmic Complexity

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053367)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053367 advisory. In the Linux kernel, the following vulnerability has been resolved: loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer where a lo...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073361)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073361 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxf...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053340)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053340 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that ha...

CVE-2026-84899

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...

CVE-2026-84930

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

CVE-2026-83544

The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-8625

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

EUVD-2026-71867

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...

CVE-2026-84899 VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...

CVE-2026-84930 CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

CVE-2026-84899

The VikWidgetsLoader WordPress plugin versions before 1.12.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to sanitize or escape a block attribute before outputting it within an inline script. This allows users with the Contributor role to store arb...

CVE-2026-84930

The CatFolders Document Gallery & PDF Library WordPress plugin versions before 2.0.7 is vulnerable to a Stored XSS flaw. The application fails to properly validate a block attribute before utilizing it as an HTML tag name within its gallery output. This allows users with the Author role or higher...