CVE-2026-89626

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

CVE-2026-89626 HID: sensor: custom: Fix field sysfs group cleanup on failure

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

CVE-2026-85630

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value th...

CVE-2026-85630: Improper Neutralization of Input During Web Page Generation

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value th...

CVE-2026-80767 HID: sensor: custom: Fix use-after-free in enable_sensor

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enablesensor enablesensorstore can call setpowerreportstate, which dereferences sensorinst-powerstate and sensorinst-reportstate. These pointers refer to entries in sensorinst-fields...

Drupal 10.3.x < 10.3.14 / 10.4.x < 10.4.5 / 11.x < 11.0.13 / 11.1.x < 11.1.5 Drupal Vulnerability (SA-CORE-2025-004)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.3.x prior to 10.3.14, 10.4.x prior to 10.4.5, 11.x prior to 11.0.13, or 11.1.x prior to 11.1.5. It is, therefore, affected by a vulnerability. - Improper Neutralization of Input During Web Page...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...

HackerOne: IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs

Specifying a report ID of another team when requesting a CSV export leaks the ID of the Custom Field Attribute in the CSV header. Request POST /reports/export HTTP/1.1 Host: localhost:8080 ... ----------868143055 Content-Disposition: form-data; name="reportids" 17 ----------868143055...