PT-2026-98196

Name of the Vulnerable Software and Affected Versions xhtml-purifier versions prior to 0.4.3 Description The library fails to HTML-entity-encode attribute values during the serialization of sanitized output. In the attributeString function, attribute values are concatenated directly into...

PT-2026-104960

In the Linux kernel, the following vulnerability has been resolved: perf: Fix addr filter ranges lifetime Lee Jia Jie reported that since event::addr filter ranges is used under RCU, it should be RCU freed...

PT-2026-104860

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfd smi ev enabled skips the suser privilege check when pid=0. PROCESS START, PROCESS END, and VMFAULT events are emitted with pid=0 while carrying another process's PID an...

PT-2026-97886

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the clocksource/drivers/timer-sun4i driver where the sun4i clkevt next event function incorrectly advertises TIMER SYNC TICKS as the min delta ticks. This allows the...

PT-2026-104904

In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidpp connect event If input register device fails, we call input free device, but keep stale pointer to the old device in hidpp-input, which could potentially lead to UAF. Fix that by resetting i...

PT-2026-98026

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the hidpp connect event function. This occurs when input register device fails, leading to a call to input free device while a stale pointer to the o...

PT-2026-98017

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the perf subsystem where event::addr filter ranges is used under RCU Read-Copy-Update, a synchronization mechanism that allows multiple readers to access data while it...

PT-2026-98077

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where perf ftrace function unregister calls unregister ftrace function without verifying if the ftrace ops was successfully registered. This leads to a warning in...

PT-2026-104984

In the Linux kernel, the following vulnerability has been resolved: perf/ftrace: Fix WARNING in unregister ftrace function perf ftrace function unregister unconditionally calls unregister ftrace function without checking whether the ftrace ops was ever successfully registered. This triggers a WAR...

PT-2026-98159

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description The video placeholder component allows crafted HTML to cause an attribute breakout...

PT-2026-98110

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A hang occurs during the teardown of ib network configurations. This issue is caused by the shutdown worker thread sleeping on the wait event call, which subsequently blocks other work...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

CVE-2026-93526

Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.4 versions...

EUVD-2026-85530

Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.4 versions...

CVE-2026-93526 WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.4 versions...

CVE-2026-93526 WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.4 versions...

CVE-2026-93526

The Event Tickets WordPress plugin (versions

SUSE CVE-2026-77164

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...

SUSE CVE-2026-93690

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...

SUSE CVE-2026-93749

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...