CVE-2026-92106: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's text from i...

CVE-2026-97882: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lea...

CVE-2026-97979: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ice: add missing xadestroy for schednodeids Commit 16dfa49406bc "ice: Introduce new parameters in iceschednode" added a schednodeids xarray to the port info structure, but never called xadestroy on it. Since xarrays can allocate...

Linux Distros Unpatched Vulnerability : CVE-2026-97979

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ice: add missing xadestroy for schednodeids Commit 16dfa49406bc ice: Introduce new parameters in iceschednode added a schednodeids xarray to the port info...

CVE-2026-97979

In the Linux kernel, the following vulnerability has been resolved: ice: add missing xadestroy for schednodeids Commit 16dfa49406bc "ice: Introduce new parameters in iceschednode" added a schednodeids xarray to the port info structure, but never called xadestroy on it. Since xarrays can allocate...

CVE-2026-98036

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtabmapupdateelem initializes special fields after obtaining an element from bpfmemcachealloc. The allocator can return a fresh, zeroed unit, or recycle one from its...

CVE-2026-97933

In the Linux kernel, the following vulnerability has been resolved: tracing: Take tracearray reference when opening a tracer options file When a tracer option file is opened, it is passed a descriptor that points to an element on the tracearray's topts array. This element has information to find...

CVE-2026-97933: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tracing: Take tracearray reference when opening a tracer options file When a tracer option file is opened, it is passed a descriptor that points to an element on the tracearray's topts array. This element has information to find...

Linux Distros Unpatched Vulnerability : CVE-2026-97222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML...

CVE-2026-97979: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ice: add missing xadestroy for schednodeids Commit 16dfa49406bc "ice: Introduce new parameters in iceschednode" added a schednodeids xarray to the port info structure, but never called xadestroy on it. Since xarrays can allocate...

openSUSE 16 Security Update : jsoup, re2j (openSUSE-SU-2026:21900-1)

"The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21900-1 advisory. This update for jsoup, re2j fixes the following issue: - CVE-2026-75140: The builder copies the entire inherited namespace map on every start element,...

Linux Distros Unpatched Vulnerability : CVE-2026-88351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32...

Linux Distros Unpatched Vulnerability : CVE-2026-98036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtabmapupdateelem initializes speci...

CVE-2026-97222: Use After Free

A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash...

CVE-2026-100174: Improper Neutralization of Input During Web Page Generation

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-67421: Missing Authorization

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

CVE-2026-56732: Improper Input Validation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating...

PT-2026-98421

Name of the Vulnerable Software and Affected Versions lazy html versions 0.1.0 through 0.1.12 Description An issue exists where improper neutralization of input during web page generation allows mutation Cross-site Scripting XSS. This occurs during a parse and serialize round-trip of...

PT-2026-98850

Name of the Vulnerable Software and Affected Versions kitty versions 0.40.0 through 0.48.x Description An out-of-bounds write exists in the natural width branch of the text sizing protocol. The screen handle multicell command function in kitty/screen.c appends each codepoint of a grapheme cluster...

CVE-2026-97864: Missing Authentication for Critical Function

A vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/unitsaddblockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is...