PT-2026-98625

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the perf/core component where list corruption can occur. A Performance Monitoring Unit PMU uses the perf sched cb inc and perf sched cb dec interface to obtain the...

PT-2026-98852

Name of the Vulnerable Software and Affected Versions Open-Web-Analytics versions prior to 1.8.2 Description A flaw in the Remote Event Queue Endpoint component allows remote attackers to trigger deserialization by manipulating the Event::loadFromArray function within the queue.php file...

CVE-2026-97865: Deserialization of Untrusted Data

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

CVE-2026-34480 Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/charsets producing invalid XML output whenever a l...

PT-2026-98999

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

Dozzle label filters do not restrict container event and statistics streams

Summary Dozzle supports per-user label filters in users.yml that are documented as an access-control boundary: "Filters are used to restrict the containers that a user can see" and "the guest user can only see containers with the label com.example.app … useful for restricting access to specific...

GHSA-XCW9-QMMF-VQXJ Dozzle label filters do not restrict container event and statistics streams

Summary Dozzle supports per-user label filters in users.yml that are documented as an access-control boundary: "Filters are used to restrict the containers that a user can see" and "the guest user can only see containers with the label com.example.app … useful for restricting access to specific...

CVE-2026-62286 Dozzle label filters do not restrict container event and statistics streams

Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment usi...

CVE-2026-91122 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting...

EUVD-2026-86293

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/sessionId/qr requires the...

CVE-2026-97422 drm/amdkfd: fix SMI event cross-process information leak

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and...

CVE-2026-97422

A vulnerability in the Linux kernel 's drm/amdkfd component allows a cross-process information leak regarding SMI events. The issue arises because the kfd_smi_ev_enabled() function skips user privilege checks when pid=0. Consequently, PROCESS_START , PROCESS_END , and VMFAULT events are emitted w...

CVE-2026-97422 drm/amdkfd: fix SMI event cross-process information leak

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfdsmievenabled skips the suser privilege check when pid=0. PROCESSSTART, PROCESSEND, and VMFAULT events are emitted with pid=0 while carrying another process's PID and...

EUVD-2026-85324

SunEditor: Critical XSS vulnerability - sanitizer bypass...

GHSA-6RF4-V2FH-M6P4 SunEditor: Critical XSS vulnerability - sanitizer bypass

Summary SUNEDITOR v2.47.10 appears to allow JavaScript execution through crafted namespaced HTML elements. The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that execute...

SunEditor: Critical XSS vulnerability - sanitizer bypass

Summary SUNEDITOR v2.47.10 appears to allow JavaScript execution through crafted namespaced HTML elements. The sanitization logic does not fully remove executable event-handler attributes from certain custom/namespaced tags. As a result, an attacker may be able to inject HTML content that execute...

WordPress Events Manager plugin 7.4.1-7.4.4 - Subscriber+ Unpublished Event and Location Disclosure vulnerability

Subscriber+ Unpublished Event and Location Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Events Manager versions 7.4.1-7.4.4...

PT-2026-98196

Name of the Vulnerable Software and Affected Versions xhtml-purifier versions prior to 0.4.3 Description The library fails to HTML-entity-encode attribute values during the serialization of sanitized output. In the attributeString function, attribute values are concatenated directly into...

PT-2026-104960

In the Linux kernel, the following vulnerability has been resolved: perf: Fix addr filter ranges lifetime Lee Jia Jie reported that since event::addr filter ranges is used under RCU, it should be RCU freed...

PT-2026-104860

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfd smi ev enabled skips the suser privilege check when pid=0. PROCESS START, PROCESS END, and VMFAULT events are emitted with pid=0 while carrying another process's PID an...