Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

SummaryAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...

kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

A flaw was found in the Linux kernel. Specifically, within the drm/xe graphics driver, two error handling issues in the xeexecqueuecreateioctl function could lead to memory corruption. This could result in a dangling pointer or a use-after-free vulnerability. A local attacker could potentially...

kernel: smb: client: fix OOB reads parsing symlink error response

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote, untrusted server could send a specially crafted symlink error response, leading to an out-of-bounds read vulnerability. This could result in the disclosure of sensitive information from the kernel's memory to a loca...

CVE-2026-60074

A flaw was found in Date::Manip. This vulnerability allows an attacker to provide specially crafted input containing non-ASCII decimal digits to the Date::Manip library for Perl. The library's parsing logic incorrectly processes these digits, truncating the input and resulting in an inaccurate da...

kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

A flaw was found in the Linux kernel. Specifically, within the drm/xe graphics driver, two error handling issues in the xeexecqueuecreateioctl function could lead to memory corruption. This could result in a dangling pointer or a use-after-free vulnerability. A local attacker could potentially...

CVE-2026-21069

Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp – Fix use-after-free on error path In the error path of sevtsminitlocked, the code dereferences t after it has been freed with kfree. The prerr statement attempts to access t-tioen and t-tioinitdone after the memory h...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules

A flaw was found in Python's decompression modules, including lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is...

PT-2026-69567

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Btrfs file system where data relocation inodes may incorrectly use inlined file extents. This occurs because the system may attempt to compress the first block of ...

📄 DjangoCRM 2.4.0 Debug Information Disclosure

A proof of concept exploit for an information disclosure vulnerability in DjangoCRM version 2.4.0. The vulnerability exists because affected installations ship with Django debug mode enabled, allowing unauthenticated attackers to trigger technical error pages that disclose sensitive application...

CVE-2026-68122: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

CVE-2026-68208: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: Fix the error code of devmkzalloc in vipprobeslice In vipprobeslice, the error check for devmkzalloc incorrectly uses PTRERRORZERO which returns 0 for NULL pointer. Return -ENOMEM for devmkzalloc failure...

PT-2026-69668

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/xe component where non-migratable faults requiring devmem incorrectly jump to the 'out' label. This behavior squashes the error code that should be returned to...

PT-2026-69522

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the ovpn module during TCP RX or TX error paths. When ovpn peer hold is called followed by schedule work for the peer-tcp.defer del work item, a race...

CVE-2026-68287: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix size calculations for 64-bit attributes netdmpacketreportfill and netdmhwpacketreportfill use nlaputu6464bit to append 64-bit attributes NETDMATTRPC and NETDMATTRTIMESTAMP. On 32-bit architectures without...

PT-2026-69444

Name of the Vulnerable Software and Affected Versions GNU Emacs for Android affected versions not specified Description An off-by-one error exists in the gvar table parser within src/sfnt.c. The shared-coordinate index boundary check in the functions sfnt vary simple glyph and sfnt vary compound...

CVE-2026-71391: Off-by-one Error

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfntvarysimpleglyph and sfntvarycompoundglyph uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font ...

PT-2026-69622

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the msi2500 driver where the msi2500 start streaming function fails to return queued buffers when an error occurs. The vb2 framework provides buffers via buf queue...

PT-2026-69859

Name of the Vulnerable Software and Affected Versions HCL BigFix Mobile affected versions not specified Description HCL BigFix Mobile is subject to information disclosure resulting from verbose error reporting and the improper handling of exceptions. This occurs when the system provides too much...