PT-2026-84866

Name of the Vulnerable Software and Affected Versions Reader Tools PDF Reader App version 98.8 Description A path traversal issue exists within the File Handler component. This occurs when the display name argument is manipulated in the ActSplashNew.handleDeeplink function, allowing a local...

PT-2026-84593

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-84441: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 browser allows a hacker to trigger a service failure.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to improper code generation. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-84604

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-84366

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta"issecure" is...

GHSA-F8FG-PG57-V4J8 league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

Summary The AttributesExtension documents a security guarantee: Note: Attributes starting with on e.g. onclick or onerror are capable of executing JavaScript code and are therefore never allowed by default. You must explicitly add them to the allow list if you want to use them. —...

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

GHSA-G47C-3XMW-Q6M2 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

XML Injection

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to XML Injection vi...

CVE-2026-83605

A flaw was found in xmldom, a JavaScript XML DOM parser. The Element.setAttribute function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. This can lead to the injection of additional attributes, including event handlers, into...

AZL-99347 CVE-2026-83605 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

DEBIAN-CVE-2026-83605

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-83605

xmldom is a pure JavaScript W3C DOM Level 2 Core module. The vulnerability lies in Element.setAttribute() , which invokes the private _createAttribute(name) path without validating the attribute name against QName , unlike Document.createAttribute(). Because XMLSerializer.serializeToString() emit...

CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...

CVE-2026-83605

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...