USN-8702-1: util-linux vulnerabilities

It was discovered that libblkid in util-linux had a heap use-after-free vulnerability during nested partition probing. An attacker who could present a crafted block device image could possibly use this issue to obtain sensitive information or cause a denial of service. CVE-2026-13595 It was...

USN-8702-1 util-linux vulnerabilities

It was discovered that libblkid in util-linux had a heap use-after-free vulnerability during nested partition probing. An attacker who could present a crafted block device image could possibly use this issue to obtain sensitive information or cause a denial of service. CVE-2026-13595 It was...

CVE-2026-82865

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82865 pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

EUVD-2026-68400

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82865

pdfme schemas versions prior to 5.5.10 are affected by a cross-site scripting (XSS) vulnerability in the multiVariableText property panel . The root cause is the assignment of unsanitized i18n label values to innerHTML , allowing an attacker who controls label overrides via options.labels to inje...

CVE-2026-82865 pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82865 pdfme schemas before 5.5.10 Cross-Site Scripting via i18n Label

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-82865

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

skitter-creek-bath-salts — Updated!

skitter-creek-bath-salts Unlockingeverything on the CPU with DRAM scrambling — PSP, C6, microcode, SMM, and anything else the specs left out. &x == &x. Usually. Poke the DRAM controller and an address can be made to land wherever you want in memory. skitter-creek-bath-salts modifies the bottom...

PT-2026-83998

Name of the Vulnerable Software and Affected Versions MetaGPT version 0.8.1 Description An OS command injection flaw exists where the rebuild class views function in metagpt/repo parser.py interpolates the path argument into a shell command using shell=True without using an argument list. This...

PT-2026-84020

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description URL uploads in php/elFinder.class.php can bypass server-side request forgery SSRF protections when PHP cURL is unavailable. The validate address function validates the IP address, but get remote...

UBUNTU-CVE-2026-58582

hw/uefi: non-NUL variable policy name causes heap-buffer-overflow in printpolicyentry...

SUSE SLED15 / SLES15 Security Update : go1.27 (SUSE-SU-2026:3830-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3830-1 advisory. - go1.27.0 released 2026-08-19 is a major release of Go. go1.27.x minor releases will be provided through Augu...

Linux Distros Unpatched Vulnerability : CVE-2026-80645

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rapidio/tsi721: prevent a bad dereference in tsi721dbdpc With a listforeach loop, if we don't find the item we are looking for in the list, then the loop exits...

CVE-2026-61405

hw/uefi: account variable policy entries against storage size...

CVE-2026-58582

hw/uefi: non-NUL variable policy name causes heap-buffer-overflow in printpolicyentry...

CVE-2026-82865: Improper Neutralization of Input During Web Page Generation

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. Attackers who control label overrides through options.labels can inject arbitrary JavaScript that executes when users open the...

CVE-2026-51153: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/ /run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from t...

CVE-2026-77348: Unintended Proxy or Intermediary

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...