CVE-2026-66353 Doggo vulnerable to cross-site scripting via unescaped date field values

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in woylie doggo allows Reflected XSS. Doggo.normalizevalue/2 in lib/doggo.ex returned date field values wrapped in :safe, ..., the Phoenix.HTML marker meaning "already escaped, emit verbatim", without...

EUVD-2026-67094

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

EUVD-2026-67092

Reflected XSS in Netron versions =9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution...

CVE-2026-81722 nltk PorterStemmer before 3.10.3 Quadratic-time DoS

nltk PorterStemmer in versions = 3.10.2 fixed in 3.10.3 contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem. The isconsonant helper walks backward over the entire run of trailing 'y' characters on every call, and measure invokes it for each stem position, causin...

CVE-2026-81693 openssl_encrypt before 1.4.9 Denial of Service via QR total field

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

EUVD-2026-67049

opensslencrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions...

CVE-2026-80574

A flaw was found in the Linux kernel's focaltech input driver. This vulnerability occurs in the focaltechprocessrelpacket function, where incorrect handling of input can lead to an array out-of-bounds write. This memory corruption issue could potentially allow an attacker to cause system...

SUSE-SU-2026:23351-1 Security update for qemu

This update for qemu fixes the following issue: - CVE-2026-3886: lack of proper validation of user-supplied data in the virtio-gpu driver can lead to local privilege escalation via an integer overflow bsc1268061. Other updates and bugfixes: - Service: switch back to tarscm. - Bug fixes:...

python: Fix of 3 CVEs

CVE-2026-15308: fix quadratic complexity CPU DoS in the incremental HTMLParser when unterminated markup declarations span many feed calls, by accumulating new data and only rescanning once enough has piled up...

CVE-2026-81676

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-5738

DoXBASE by BilPark Informatics Technologies Industry and Trade Inc. is affected by a reflected cross-site scripting (XSS) vulnerability, described as enabling Cross Zone Scripting due to improper input neutralization during web page generation. The issue affects DoXBASE versions through 27082026 ...

EUVD-2026-67126

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in BilPark Informatics Technologies Industry and Trade Inc. DoXBASE allows Cross Zone Scripting. This issue affects DoXBASE: through 27082026. NOTE: The vendor was contacted early about this disclosur...

CVE-2026-5738 Reflected XSS in BilPark's DoXBASE

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in BilPark Informatics Technologies Industry and Trade Inc. DoXBASE allows Cross Zone Scripting. This issue affects DoXBASE: through 27082026. NOTE: The vendor was contacted early about this disclosur...

CVE-2026-76848

A flaw was found in TypeORM. The SelectQueryBuilder.distinctOn function, when used with PostgreSQL-family drivers, does not properly validate or escape client-controlled input. A remote attacker can exploit this vulnerability by providing malicious SQL expressions, leading to SQL injection. This...

CVE-2026-81673 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

WordPress Restore PayPal Standard for WooCommerce plugin < 3.1.1 - Payment Bypass via Unvalidated receiver_email vulnerability

Payment Bypass via Unvalidated receiveremail vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Accept PayPal & Stripe with Subscriptions for WooCommerce versions 3.1.1...

CVE-2026-80572

A flaw was found in the Linux kernel's byd input driver. A race condition exists during device disconnection where the byddisconnect function frees private data before ensuring that a timer callback, bydcleartouch, has completed. This can lead to the callback attempting to access memory after it...

CVE-2026-80566

A flaw was found in the hynitroncstxxx driver in the Linux kernel. This vulnerability allows an attacker to provide specially crafted touch input that can bypass validation checks for touch count and finger identifiers IDs. This improper handling can lead to the corruption of the touch state or t...

CVE-2026-80559

A flaw was found in the Linux kernel's sur40 input device driver. Due to improper ordering of device registration, a local user could trigger a race condition by opening the input device immediately after its registration. This could lead to the system accessing uninitialized data, resulting in a...

CVE-2026-80567

A flaw was found in the Linux kernel. The synaptics-rmi4 input driver's rmif54bufferqueue function failed to propagate errors from its worker thread. This oversight could result in the delivery of stale or uninitialized memory to user applications, potentially leading to information disclosure or...