DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

Summary The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an INPLACE hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay...

GHSA-C6GR-QVV4-5V3F DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Summary DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled...

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Summary DOMPurify drops attributeName attributes whose value contains href, so an allowed or can't rewrite a link's href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn't lowercase in XHTML mode. In XHTML the attribute is spelled...

npm: DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

npm: DOMPurify: SMIL attributeName=href guard is skipped when PARSERMEDIATYPE is application/xhtml+xml vulnerability discovered by ? in WordPress npm dompurify versions = 3.4.16...

CGA-3Q7M-CRM4-24VH

Bulletin has no description...

CGA-265H-84Q8-JJV8

Bulletin has no description...

CGA-Q85C-JMCQ-C7VF

Bulletin has no description...

CGA-825W-G2RG-XV4X

Bulletin has no description...

CVE-2026-41940-Security-Patch

CVE-2026-41940-Security-Patch Unofficial temporary patch for the CVE-2026-41940 vulnerability Can be used for temporary defense Please upgrade to the official release as soon as conditions permit cPanel Security Announcement:...

EUVD-2026-107551

nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc...

GHSA-PJVX-PRJX-H659 nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

Summary nbconvert = v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc. In ExtractOutputPreprocessor,...

nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

Summary nbconvert = v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc. In ExtractOutputPreprocessor,...

GHSA-XCQ7-P3PF-P88H OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Summary TraceState.fromheader splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request wit...

OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

Summary TraceState.fromheader splits the inbound W3C tracestate header with a regular expression that starts with an unbounded optional-whitespace run, and no length limit is applied first. A run of spaces or tabs that is not followed by a comma costs ON² CPU. A single unauthenticated request wit...

GHSA-RXP7-6HXX-X8Q5 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Summary new Address6 and Address6.isValid strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before...

EUVD-2026-103378

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process...

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Summary new Address6 and Address6.isValid strip a zone identifier with the pattern /%.$/ before they apply the 45-character length limit. When the string holds many % characters followed by a line terminator, the pattern is retried from every % and each attempt scans to the line terminator before...

NPM: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

NPM: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process vulnerability discovered by ? in WordPress npm ip-address versions = 10.7.3...

GHSA-CG8M-R9F2-5WM2 Black: GitHub Action installs unvalidated required-version from pyproject.toml

Summary The GitHub Action bundled with Black can read the version from tool.black.required-version if usepyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous...

Black: GitHub Action installs unvalidated required-version from pyproject.toml

Summary The GitHub Action bundled with Black can read the version from tool.black.required-version if usepyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous...