CVE-2026-83610 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...

CVE-2026-84118

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84118

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84118 Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84118

A use-after-free vulnerability exists in the SpiderMonkey GC component (Bug 2057457) affecting Mozilla Firefox and Thunderbird . The root cause is that version 154 conflates per-zone atom mark bitmaps with reference tracking; specifically, a weak CacheIR edge to a Symbol is not re-marked when the...

EUVD-2026-69070

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84118 Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84118

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84192

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

CVE-2026-84192 LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

CVE-2026-84191 LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

CVE-2026-84191

LibreNMS versions prior to 26.5.0 contain stored cross-site scripting (XSS) vulnerabilities in VRF display pages. The root cause is that SNMP-polled fields—mplsVpnVrfDescription , vrf_name , and mplsVpnVrfRouteDistinguisher —are rendered without sanitization. An attacker controlling a monitored n...

CVE-2026-84191 LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

CVE-2026-84191 LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields

LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrfname, and mplsVpnVrfRouteDistinguisher fields from SNMP polling are rendered without sanitization. Attackers controlling a monitored network device can inject arbitrary...

CVE-2026-82072

An out of bounds read flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=534416978 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security...

Linux Distros Unpatched Vulnerability : CVE-2026-83615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

ROS-20260901-73-0015

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...

ROS-20260901-73-0014

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...

PT-2026-84505

Name of the Vulnerable Software and Affected Versions joi versions 16.0.0 through 17.13.4 joi versions 18.0.0 through 18.2.3 Description The internals.rename implementation in lib/types/keys.js, used by object.rename, allows a schema to rename keys using a regular-expression source and a...

Divi < 4.27.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter

Description The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr instead of escurl before being...