DEBIAN-CVE-2026-83610

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...

AZL-99339 CVE-2026-83610 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...

SUSE-SU-2026:3916-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls

This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...

CVE-2026-83610

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...

SUSE CVE-2026-72315

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix busy dentry warning on unmount after DIO Commit c68337442f03 "cifs: Fix busy dentry used after unmounting" fixed the issue in cifs where deferred close of a file led to a dentry reference count not being released...

SUSE CVE-2026-74608

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifstryaddingchannels cifstryaddingchannels takes a temporary reference to an interface before dropping ifacelock. If cifssesaddchannel fails, it drops that reference and then increments...

CVE-2026-84148 Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users o...

CVE-2026-80721

A flaw was found in the Linux kernel's Bluetooth ISO Isochronous Stream implementation. This vulnerability occurs because the system does not properly clear references to connection handles hcon after a connection is deleted. This oversight can lead to unpredictable system behavior or instability...

CLEANSTART-2026-KQ21500 Security fixes in grafana 12.3.10-r1

Package grafana version 12.3.10-r1 fixes 15 vulnerabilities: ghsa-r277-6w6q-xmqw, ghsa-jpcw-4wr7-c3vq, ghsa-gcjh-h69q-9w9g, CVE-2026-21728, CVE-2026-28377...

CVE-2026-82749

Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent... scoping filter to match unintended records when the referenced parent field cannot be resolved. Loading a relationship whose filter references parent... resolves that expression against the parent record...

NLTK Downloader Bypass Write Delete

The vulnerability of the nltk.downloader.Downloader.download and nltk.downloader.Downloader.incrdownload components of the NLTK library, which are used for symbolic and statistical processing of natural language, is related to an incorrect definition of symbolic references before accessing files...

Linux Distros Unpatched Vulnerability : CVE-2026-83610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

CVE-2026-82395 Sulu: Media move/update authorization bypass (IDOR)

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...

EUVD-2026-68767

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacementsubscriptionid to a subscription ID belonging to another user. The write is accepted, and later the stats logic...

CVE-2026-53507

oasdiff-action , a GitHub Action that detects breaking changes in OpenAPI specs and posts reviews on pull requests, contained a flaw prior to version 0.0.51 where external $refs in the spec were resolved by default (allow-external-refs: true). On a fork pull request in a public repository, an att...

Directory Traversal

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CVE-2026-19616

creationtimestamp| type| source ---|---|--- 2026-08-31 14:14:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/35vjztok5lmwx 2026-08-31 20:52:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mufryf3o4g2h...

CVE-2026-80642

A flaw was found in the Linux kernel's liveupdate subsystem. This vulnerability arises from improper reference counting of incoming File-Lifecycle-Bound FLB data. A subsystem might hold onto FLB data for an extended period, and without proper reference counting, the FLB structure could be...

EUVD-2026-68407

ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in...

PT-2026-83986

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacement subscription id to a subscription ID belonging to another user. The write is accepted, and later the stats logic...