CVE-2026-104426

Zebra versions before 6.1.0 are susceptible to an inefficient algorithmic complexity vulnerability (CWE-407) within the remaining_transaction_value function. The root cause is the cloning of the entire block-level spent-UTXO map for every transaction during contextual verification. This allows an...

PT-2026-104238

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent error map. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates,...

PT-2026-104237

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining transaction value that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input...

CVE-2026-104057 Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

CVE-2026-104057 Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

CVE-2026-104057 Podgrab Unauthenticated DoS via Concurrent Map Access in WebSocket Handler

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

EUVD-2026-91004

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

SUSE CVE-2026-98033

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames Callback frame constructors initialize map-typed argument registers with markregknownzero and then restore mapptr. This clears mapuid, which is the only field distinguishing inn...

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifical...

CVE-2026-96256

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

CVE-2026-96256 Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

CVE-2026-96256

The Gutenberg Essential Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 6.4.5 . The flaw resides in the Google Map block's 'marker' attribute due to inadequate input sanitization and output escaping of marker title and content values....

CVE-2026-96813

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

EUVD-2026-90571

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-96813 Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-96813 Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-96813

The Form Maker by 10Web WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.15.47 . The root cause is insufficient input sanitization and output escaping within the Mark on Map Longitude/Latitude Fields . This allows unauthenticated attackers ...

CVE-2026-96813: Improper Neutralization of Input During Web Page Generation

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-96256: Improper Neutralization of Input During Web Page Generation

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Map block's 'marker' attribute in versions up to, and including, 6.4.5 This is due to insufficient input sanitization and output escaping ...

CentOS Linux 7 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-server / etc (CENTOS7:CLSA-2026:1784042725)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1784042725 advisory. - A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB X Keyboard Extension modifier map handling. ...