CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-83605

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

SUSE CVE-2026-74617

In the Linux kernel, the following vulnerability has been resolved: dibs: initialise dibs-lock in dibsdevalloc dibs-lock is initialised by dibsdevadd, but a dibs device can already take interrupts before that call: ismprobe runs ismdevinit, and hence requestirq, before it calls dibsdevadd. No...

SUSE CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

EUVD-2026-69087

Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CLEANSTART-2026-DL23987 Security fixes in kubernetes-event-exporter 1.5-r1

Package kubernetes-event-exporter version 1.5-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-JJ72716 Security fixes in kubernetes-event-exporter 1.6.1-r1

Package kubernetes-event-exporter version 1.6.1-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-XC36921 Security fixes in kubernetes-event-exporter 1.5-r3

Package kubernetes-event-exporter version 1.5-r3 fixes 3 vulnerabilities: CVE-2026-56852, CVE-2026-41178, ghsa-259r-337f-4rfw...

CLEANSTART-2026-QH63910 Security fixes in kubernetes-event-exporter 1.6.1-r3

Package kubernetes-event-exporter version 1.6.1-r3 fixes 1 vulnerabilities: CVE-2026-56852...

CLEANSTART-2026-ZT42186 Security fixes in kubernetes-event-exporter 1.5-r2

Package kubernetes-event-exporter version 1.5-r2 fixes 1 vulnerabilities: CVE-2026-46600...

CLEANSTART-2026-IZ37366 Security fixes in kubernetes-event-exporter 1.6.1-r2

Package kubernetes-event-exporter version 1.6.1-r2 fixes 1 vulnerabilities: CVE-2026-46600...

WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by 20kilograma in WordPress Plugin WP Event SOlution versions = 4.1.22...

PT-2026-84507

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.3 SVGO versions 3.0.0 through 3.3.4 SVGO versions 4.0.0 through 4.0.9 Description The removeScripts plugin known as removeScriptElement in versions 2 and 3, implemented in plugins/removeScripts.js, fails to...

Linux Distros Unpatched Vulnerability : CVE-2026-82397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with...

Linux Distros Unpatched Vulnerability : CVE-2026-83613

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

Linux Distros Unpatched Vulnerability : CVE-2026-83605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and ...

PT-2026-89954

Package kubernetes-event-exporter version 1.6.1-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

PT-2026-89944

Package kubernetes-event-exporter version 1.5-r1 fixes 1 vulnerabilities: ghsa-hrxh-6v49-42gf...

Allocation of Resources Without Limits or Throttling

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through parsebodyarguments in tornado/httputil.py and parseqsbytes in...