TencentOS Server 3: libXfont2 (TSSA-2026:0901)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0901 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-47666

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

CVE-2026-47666 Penpot: Stored XSS via custom font family name injected into a @font-face style rule

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

CVE-2026-47666

Penpot (open-source design and prototyping platform) versions up to and including 2.14.3 are affected by a stored XSS via custom font family names. Arbitrary font-family strings are interpolated into a @font-face CSS rule and injected via innerHTML without sanitization, allowing an attacker to br...

CVE-2026-47666 Penpot: Stored XSS via custom font family name injected into a @font-face style rule

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. Becaus...

PT-2026-82332

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3 Description Stored cross-site scripting occurs when custom font family names are interpolated into a @font-face CSS rule and injected into the page as HTML without sanitization. The backend accepts an arbitrary...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098835)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098835 advisory. In the Linux kernel, the following vulnerability has been resolved: fbcon: Avoid OOB font access if console rotation fails Clear the font buffer if the reallocation...

RHSA-2026:59312 Red Hat Security Advisory: libXfont2 security update

Bulletin has no description...

Mozilla: Arbitrary JavaScript execution in PDF.js

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...

Mozilla: Arbitrary JavaScript execution in PDF.js

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...

libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write

A flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privile...

libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the...

Important: Red Hat Security Advisory: libXfont2 security update

An update for libXfont2 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: libXfont2 security update

An update for libXfont2 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write

A flaw was found in the libXfont2 font-server client. A remote attacker, by operating a malicious font server, could exploit an out-of-bounds read/write vulnerability. This occurs because the client incorrectly handles font data, leading to an out-of-bounds memory access. This can lead to privile...

libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client

A flaw was found in the libXfont2 font-server client. This heap buffer overflow vulnerability allows a malicious font server to send specially crafted glyph data. The fsreadglyphs function fails to properly validate the total size of the incoming data, leading to an overwrite of memory beyond the...

RHEL 9 : libXfont2 (RHSA-2026:59312)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:59312 advisory. X.Org X11 libXfont2 runtime library Security Fixes: libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679...

RHEL 9 : libXfont2 (RHSA-2026:59311)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:59311 advisory. X.Org X11 libXfont2 runtime library Security Fixes: libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count CVE-2026-53392 In the Linux kernel, the following vulnerability has been resolved: nfsd: reset write verifier on deferred writeback errors CVE-2026-53393 In th...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: fbcon: The old font data is always restored in fbcondosetfont. The commit a5a923038d70 fbdev: fbcon: Properly revert changes when vcresize fails started restoring old font data upon failure of vcresize. However, this only applies...