Debian dsa-6529 : libwebsockets-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6529 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6529-1 [email protected] https://www.debian.org/security/ Moritz...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95364): chromium -- security fixes

Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-102823: Improper Input Validation

Russh is a Rust SSH client and server library. Prior to 0.63.1, clientreadauthenticated in russh/src/client/encrypted.rs forwards CHANNELDATA, CHANNELEXTENDEDDATA, CHANNELEOF, CHANNELCLOSE, CHANNELOPENFAILURE, CHANNELSUCCESS, CHANNELFAILURE, and CHANNELREQUEST subtypes exit-status, exit-signal, a...

CVE-2026-102600: Improper Input Validation

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as proto or constructor can resolve...

CVE-2026-100370

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the...

CVE-2026-100370 DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the...

CVE-2026-100370 DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the...

CVE-2026-100370

The DOMSanitizer library for PHP 7.3+ is vulnerable to an input-validation defect in its isDangerousUrl() method prior to version 1.0.15 . While the sanitizer correctly rejects the "javascript:" scheme, it only rejects the "data:" scheme if the literal substring "onload" is present. This allows a...

EUVD-2026-88477

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the...

CVE-2026-100370 DOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation

DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl method is responsible for rejecting dangerous URL values in the href and xlink:href attributes. The weakness is that "javascript:" is rejected as a scheme, while "data:" is rejected only when the...

Improper Input Validation

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into the...

Improper Input Validation

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merge...

EUVD-2026-88337

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

CVE-2026-12342 SailPoint IdentityIQ Improper Form Validation Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

CVE-2026-12342 SailPoint IdentityIQ Improper Form Validation Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

CVE-2026-12342

This vulnerability affects all versions of SailPoint IdentityIQ . It allows an unauthenticated user to achieve remote code execution (RCE) on the IdentityIQ server. The root cause is identified as improper input validation of submitted web service API content. No specific exploit links or patch v...

⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats

A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface. Elsewhere, weak service accounts, old bugs, exposed...

CVE-2026-101015

A flaw was found in OpenDMARC. A remote attacker can bypass Domain-based Message Authentication, Reporting, and Conformance DMARC policy checks by submitting domain names containing equivalent Unicode dot characters. Due to improper input validation in domain handling, the service fails to enforc...

Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772

Overview On September 27, 2026, Citrix disclosed eight new vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including two critical remote code execution RCE vulnerabilities: CVE-2026-88771 and CVE-2026-88772. Both of these RCE vulnerabilities carry a critical CVSSv4 score of 9.5, an...

CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Sunday added two critical Citrix NetScaler ADC and Gateway flaws to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation. The vulnerabilities are listed below - CVE-2026-88771 CVSS score: 9.5 - ...