CVE-2026-74440

Summary: CVE-2026-74440 affects Linux kernel DRM/XE, where a user job could race with kernel operations on external buffer objects (BOs) due to an incomplete dependency model. Root cause: during xe_exec_ioctl(), only the VM’s dma-resv KERNEL slot was added as a dependency, omitting external BOs (...

CVE-2026-74440

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

EUVD-2026-59747

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Wait on external BO kernel fences in exec IOCTL Before arming a user job, xeexecioctl only added the VM's dma-resv KERNEL slot as a dependency. That slot covers rebinds and the kernel operations of the VM's private BOs, b...

PT-2026-72892

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xe exec ioctl function where the system failed to wait on the DMA RESV USAGE KERNEL slots of external Buffer Objects BOs. The DMA RESV USAGE KERNEL slot is a...

SUSE CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, php-fpmexporter, whereabouts, dagdotdev, kubernetes-dashboard-metrics-scraper, cloudflared, rancher-telemetry, sqlexporter, bank-vaults, argo-rollouts, gitness, restic, nfs-subdir-external-provisioner, percona-server-mongodb-operator,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, php-fpmexporter, whereabouts, dagdotdev, kubernetes-dashboard-metrics-scraper, cloudflared, rancher-telemetry, sqlexporter, bank-vaults, argo-rollouts, gitness, restic, nfs-subdir-external-provisioner, percona-server-mongodb-operator,...

CVE-2026-34492

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-16708

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration...

CVE-2026-34492

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-17184

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-17184, enabling a remote attacker to execute arbitrary code due to external control of a file name or path. The issue affects the GUI and related components of IBM Db2 Mirror for i. IBM’s bulletin lists remediation via platf...

CVE-2026-17184 IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path...

CVE-2026-17184 IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path...

CVE-2026-16708

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration...

CVE-2026-16708

CVE-2026-16708 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The advisory reports that a remote attacker could obtain sensitive information due to external control of system configuration. The IBM Security Bulletin lists this vulnerability among multiple issues, attributing the root ca...

CVE-2026-16708 IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration...

CVE-2026-16708 IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration...

CVE-2026-73490

A flaw was found in Loofah. The HTML5 sanitizer incorrectly applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A remote attacker could exploit this by crafting a sanitized SVG that referenc...

CVE-2026-69101

Datavane TIS v5.0.0 is affected by an XXE injection via the doEditWorkflow endpoint. The issue arises because XML is parsed using an unhardened DocumentBuilderFactory with external entities and DTD loading enabled, enabling authenticated attackers to perform SSRF and out-of-band file exfiltration...

CVE-2026-69101 Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint

Datavane TIS v5.0.0 contains an XML external entity XXE injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an...