phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

Summary The SvgSanitizer::decodeAllEntities method limits recursive entity decoding to 5 iterations. By wrapping each character of javascript in an href attribute value with 5 levels of & encoding around numeric HTML entities e.g., amp;amp;amp;106; for j, an attacker can bypass both isSafe...

GHSA-WHQH-9PQ5-C7R3 phpMyFAQ has a SVG Sanitizer Entity Decoding Depth Limit Bypass Leading to Stored XSS

Summary The SvgSanitizer::decodeAllEntities method limits recursive entity decoding to 5 iterations. By wrapping each character of javascript in an href attribute value with 5 levels of & encoding around numeric HTML entities e.g., amp;amp;amp;106; for j, an attacker can bypass both isSafe...

CVE-2026-46362

creationtimestamp| type| source ---|---|--- 2026-05-06 20:11:52+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-hpgw-ww76-c68r...

CVE-2025-63705

creationtimestamp| type| source ---|---|--- 2026-05-06 19:56:42+00:00| seen| https://gist.github.com/6en6ar/a2ac44da0f4e580190be3e66cfbb9a4a...

CVE-2025-63704

creationtimestamp| type| source ---|---|--- 2026-05-06 19:53:03+00:00| seen| https://gist.github.com/6en6ar/d62f614dbb2b1032b5e45a56fe26ec8b...

CVE-2026-44117 OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests...

CVE-2026-44116

OpenClaw prior to version 2026.4.22 is affected by a server-side request forgery in the Zalo plugin’s sendPhoto function, failing to validate outbound photo URLs against the SSRF guard. An attacker can bypass SSRF protection by supplying malicious photo URLs to the Zalo Bot API, enabling unauthor...

CVE-2025-63703

creationtimestamp| type| source ---|---|--- 2026-05-06 19:46:52+00:00| seen| https://gist.github.com/6en6ar/bdc8e0d472406ab98431f10273cbdbf3...

CVE-2026-33079

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping...

DEBIAN-CVE-2026-33079

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping...

CVE-2026-33079

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping...

CVE-2025-31978

creationtimestamp| type| source ---|---|--- 2026-05-06 18:14:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7clph4up2n...

CVE-2026-43130

A flaw was found in the Linux kernel. When handling PCIe devices in scalable mode, the kernel may attempt to flush the device IOTLB Input/Output Translation Lookaside Buffer without verifying if the PCIe device is still accessible after a link-down fault. This improper handling during resource...

CVE-2026-8027

creationtimestamp| type| source ---|---|--- 2026-05-06 18:01:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7bubgd5g2t...

CVE-2025-71292

A flaw was found in the Linux kernel's Journaled File System JFS. This vulnerability occurs when a directory's link count nlink reaches its maximum value and a rename operation is performed on a child directory. This can cause the link count to wrap around, leading to an nlink overflow. The...

CVE-2026-33079

Mistune 3.0.0a1–3.2.0 contains a ReDoS in LINK_TITLE_RE used for parsing link titles, enabling exponential backtracking when processing Markdown strings with repeated ! sequences and no closing quote. The ambiguity arises from overlapping alternatives in the two branches (double-quoted and single...

CVE-2026-33079 Mistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping...

CVE-2026-33079

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping...

CVE-2026-33079

In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS Regular Expression Denial of Service vulnerability in LINKTITLERE that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping...

CVE-2026-20167

creationtimestamp| type| source ---|---|--- 2026-05-06 17:23:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml77pxhqef2z 2026-05-06 19:32:46+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ml7gx7ppwt2e 2026-05-07 00:53:19+00:00| seen|...