Improper Input Validation

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power o...

CVE-2026-64441

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. This vulnerability involves out-of-bounds reads in several functions responsible for parsing information elements IE and attributes. Due to missing checks on the size of incoming data, these functions can read beyond the intended memo...

DEBIAN-CVE-2026-6879

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

PSF-2026-34

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2026-6879 Quadratic Behavior in xml.etree.ElementPath Index Predicates

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

PT-2026-65499

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CVE-2025-59172

Ericsson Packet Core Controller PCC versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root...

EUVD-2025-210512

Ericsson Packet Core Controller PCC versions prior to 1.38 contain an Improper Neutralization of Special Elements vulnerability allowing an attacker to execute arbitrary code as root...

UBUNTU-CVE-2026-64536

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...

CVE-2026-64442

A flaw was found in the Linux kernel's rtl8723bs Wi-Fi driver. Insufficient boundary checks in the information element IE parsing loops within the issueassocreq and joincmdhdl functions allow a remote attacker to cause an out-of-bounds read. By sending specially crafted, truncated IE data from a...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Handling of Invalid Use of Special Elements (CVE-2025-61984)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505703; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Handling of Structural Elements (CVE-2026-23154)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505600; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Handling of Structural Elements (CVE-2026-43033)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505632; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Cross-site Scripting (XSS)

DOMPurify is vulnerable to Cross-site Scripting XSS. The vulnerability is due to failure to execute the afterSanitizeElements hook for custom elements allowed through CUSTOMELEMENTHANDLING.tagNameCheck, allowing sensitive attributes to bypass sanitization and be reused in innerHTML sinks to execu...

EUVD-2026-48787

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

CVE-2026-64443 staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in updatebeaconinfo IE loop The IE parsing loop in updatebeaconinfo advances by pIE-length + 2 each iteration but only guards on i length from one byte past the allocated receive buffer...

CVE-2026-64444 staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp IE loop The IE parsing loop in OnAssocRsp advances by pIE-length + 2 each iteration but only guards on i length from pframepktlen, which is one byte past the allocated receive buffer...

EUVD-2026-48786

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issueassocreq and joincmdhdl Two IE parsing loops are missing the header bounds checks before they dereference pIE-length: - issueassocreq walks pmlmeinfo-network.ies to build the...

Linux Distros Unpatched Vulnerability : CVE-2026-66010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing attributes to...

CVE-2026-66010

A flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cross-Site Scripting XSS attacks. An attacker could exploit...