PT-2026-90331

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page lcns index by the log record The copy lcns loop and the redo shorten loop index page lcns at j + i, where i runs up to the log record's lcns follow. That count is checked only against the record's own length,...

CVE-2026-16960

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

CVE-2026-16960 Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

EUVD-2026-74701

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records including email addresses and roles and arbitrary site options...

CVE-2026-16960

The Loops & Logic WordPress plugin (versions before 4.3.0 ) exposes an unrestricted public template-data action , allowing unauthenticated users to read arbitrary user records—including email addresses and roles —as well as arbitrary site options. The root cause is a missing permission check on t...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-104992)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104992 advisory. Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input,...

CVE-2026-82123

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Tangible Loops & Logic...

CVE-2026-82123

CVE-2026-82123 is a reflected cross-site scripting (XSS) vulnerability in the Tangible Loops & Logic WordPress plugin, caused by improper neutralization of input during web page generation. Per the assigned CVSS 3.1 score of 6.5 (Medium) , the attack vector is network-based with low complexity, r...

EUVD-2026-67459

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Tangible Loops & Logic...

CVE-2026-82123 WordPress Loops & Logic - Reflected XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Tangible Loops & Logic...

Astra Linux – Vulnerability in Wireshark

Excessive loops in multiple dissectors in Wireshark versions 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 allow denial of service via packet injection or crafted capture files...

Astra Linux – Vulnerability in Wireshark

MONGO and ZigBee TLV dissector have infinite loops in Wireshark versions 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22. These bugs allow for denial of service through packet injection or with properly crafted capture files...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: EROFs: Avoid linking hooked chains to prevent loops in deduplicated compressed images. After subjecting EROFS to heavy stress using several images that included a handcrafted image with repeated patterns for over 46 days, I...

Astra Linux – Vulnerability in qt4-x11, qtbase-opensource-src

A issue was discovered in Qt before version 5.15.15, in versions 6.x before 6.2.10, and in versions 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion...

Security update for wireshark

This update for wireshark fixes the following issues: Update to version 4.6.7: CVE-2026-5299: ICMPv6 dissector crash bsc1263757. CVE-2026-5401: AFP dissector crash bsc1263756. CVE-2026-5402: TLS dissector crash and possible code execution bsc1263755. CVE-2026-5403: SBC audio codec crash bsc126376...

CVE-2026-67199

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

EUVD-2026-52695

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

CVE-2026-67199 Perspective 5.0.0 DoS via Loop Expression Evaluation

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

CVE-2026-67199

Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers can embed an arbitrarily large...

CVE-2026-67199

CVE-2026-67199 affects Perspective 5.0.0. The vulnerability arises from evaluating an expression in a TableMakeViewReq message that can contain unbounded for/while loop constructs. An attacker can embed an arbitrarily large iteration count in a single expression column evaluated per table row, ca...