PT-2026-68623

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An Open Redirect issue exists in the HTML5 scrubber of the software. A remote attacker can force visitors to navigate to an untrusted site by inserting a element into sanitized HTML. Th...

DEBIAN-CVE-2026-19023

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

Nuxt: Unauthorized Component Instantiation via Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...

GHSA-48HR-524C-V5W3 Nuxt: Unauthorized Component Instantiation via Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...

Exploit for NULL Pointer Dereference in Linux Linux_Kernel

--- CVE-2026-23002 – 5G NAS Message Buffer Overflow in gNode...

CVE-2026-64578 ksmbd: validate compound request size before reading StructureSize2

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads pdu-StructureSize2 without first checking that the compound element is large...

CVE-2026-66344

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability CWE-427. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

CVE-2026-66344

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-66344.

SUSE CVE-2026-65911

In DOMPurify through 3.3.3, function predicates supplied via ADDATTR or ADDTAGS to DOMPurify.sanitize persist in internal state EXTRAELEMENTHANDLING across subsequent sanitize calls on the same instance. If a later call on the same instance provides ADDATTR or ADDTAGS as an array rather than a...

The vulnerability of the FileZilla Client’s FTP client, related to an uncontrolled search path element, allows a hacker to execute arbitrary code and gain full control over the system.

The vulnerability of the FileZilla Client FTP client is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain full control over the system...

CVE-2026-66344: Uncontrolled Search Path Element

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability CWE-427. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

ROS-20260805-73-0023

The vulnerability of the traceprintkseq function in the Linux operating system’s kernel is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a perpetrator to cause service failures...

CVE-2026-69149 Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-69092

CVE-2026-69092 affects Admidio versions before 5.0.11. The issue is a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or Ligh...

CVE-2026-64446

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. A local user can exploit this vulnerability by supplying a crafted Wi-Fi Protected Access WPA Information Element IE during a connection request. This can lead to a one-byte heap buffer overflow, potentially causing memory corruption...

CVE-2026-14817

The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...

CVE-2026-14817

The Element Pack Addons for Elementor WordPress plugin, versions before 8.7.13 , is vulnerable to a DOM-based stored XSS flaw. The root cause is a failure to sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser....

CVE-2026-14817

The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...

WordPress Element Pack Addons for Elementor plugin < 8.7.13 - Contributor+ DOM-Based Stored XSS vulnerability

Contributor+ DOM-Based Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Element Pack Elementor Addons versions 8.7.13...

CVE-2026-14817 Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes

The Element Pack Addons for Elementor WordPress plugin before 8.7.13 does not sanitize option values passed through certain data attributes before a bundled front-end library re-parses and renders them in the browser, allowing users with contributor-level access or higher to inject arbitrary...