The vulnerability of the mac80211/ocb.c component in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the mac80211/ocb.c component in the Linux operating system is related to improper handling of the absence of a specific element. Exploiting this vulnerability can allow an attacker to cause a service failure...

UBUNTU-CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

EUVD-2026-57626

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-72787

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787 Craft CMS 5.0.0-RC1 before 5.10.8 Stored XSS via Draft Name

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72787

CVE-2026-72787 affects Craft CMS versions before 5.10.8. A stored XSS exists in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browser of hig...

EUVD-2026-57447

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

CVE-2026-72786

Craft CMS versions before 5.10.8 are vulnerable to an authentication bypass in the elements/save action. The root cause is an unprotected newPassword field in the User element save flow, which can be exploited by authenticated users with edit users permission to reset any user’s password (includi...

CVE-2026-73433

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

EUVD-2026-57366

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command...

CVE-2026-72787: Improper Neutralization of Input During Web Page Generation

Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control panel where draft names are rendered without HTML encoding in element chips and cards. A low-privilege user who can create element drafts can inject malicious JavaScript that executes in the browse...

SUSE CVE-2026-68316

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix element size accounting for cmd stream validation There are 2 issues with the element size handling in the command stream validation which result in too small of a size calculated when the element size is...

CVE-2026-68316

A flaw was found in the Linux kernel's accel: ethosu component. This vulnerability involves incorrect element size accounting during command stream validation. Specifically, the calculation for element sizes of 16, 32, or 64 bits can be too small, and the element size is entirely missing for the...

GHSA-4HC4-QJFX-WJF3 Duplicate Advisory: Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xxpx-f366-4xpq. This link is maintained to preserve external references. Original Description Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding on...

Duplicate Advisory: Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xxpx-f366-4xpq. This link is maintained to preserve external references. Original Description Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding on...

CVE-2026-72925

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swchtmlminifier 59.0.0, the minifyJson processing in crates/swchtmlminifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script...

CVE-2026-72925 SWC HTML minifier may allow script element breakout when minifying embedded JSON

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swchtmlminifier 59.0.0, the minifyJson processing in crates/swchtmlminifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script...

CVE-2026-72785

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...

CVE-2026-72785 Craft CMS before 5.10.6 Authorization Bypass via structures/move-element

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...