CVE-2026-103923: Reliance on Untrusted Inputs in a Security Decision

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

PT-2026-103955

Name of the Vulnerable Software and Affected Versions KaTeX versions 0.11.0 through 0.18.1 Description KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration. This allows...

PT-2026-105125

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num...

Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1775817651)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775817651 advisory. - Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 3...

Rocky Linux 10.0 [CIQ] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_9304)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20259304 advisory. xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors CVE-2025-49175 xorg-x11-server-Xwaylan...

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Summary hono/jsx does not HTML-escape a plain string placed directly as a child or fallback of Suspense or ErrorBoundary, as the only child of a Context.Provider, or as the root value of renderToString / renderToReadableStream from hono/jsx/dom/server. Such a string is emitted as markup instead o...

CVE-2026-102105 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

EUVD-2026-90314

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

CVE-2026-47567

A flaw was found in the NVIDIA GPU display driver. A local user with standard privileges can trigger this vulnerability within the kernel mode layer by exhausting the Direct Rendering Manager DRM virtual memory area VMA offset address space. This uncontrolled resource consumption can lead to a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the URL parsing of matrix parameters and child outlet names, which stores them as keys on plain JavaScript objects, so a numeric string key leads V8 to convert the object to a dens...

Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...

GHSA-FF3F-86QR-9CV3 Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. When @angular/router parses incoming request URLs, it extracts path segments, matrix parameters, and child outlets into plain JavaScript objects Record. When matrix...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

exynos DRM Heap Buffer Overflow DoS

The vulnerability of the vidiconnectionioctl function in the drivers/gpu/drm/exynos/exynosdrmvidi.c module of the Direct Rendering Infrastructure DRI driver for the Linux kernel is related to the use of an unreliable pointer. Exploiting this vulnerability can allow an attacker to access protected...

amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu Heap Buffer Overflow DoS

The vulnerability of the amdgpuamdkfdgpuvmallocmemoryofgpu function in the drivers/gpu/drm/amd/amdgpu/amdgpuamdkfdgpuvm.c file of the Direct Rendering Infrastructure DRI driver for AMD GPU cores in the Linux operating system is related to the copying of buffers without checking the size of the...

Linux Kernel DRI DoS

The vulnerability of the rzg2lmipidsiatomicdisable function in the drivers/gpu/drm/renesas/rz-du/rzg2lmipidsi.c driver of the Direct Rendering Infrastructure DRI component of the Linux operating system is related to the improper disabling or release of resources. Exploiting this vulnerability can...

amd amdgpu sdma_v4_0 Ring Eruption DoS

The vulnerability of the sdmav40ringemitfence function in the drivers/gpu/drm/amd/amdgpu/sdmav40.c driver for AMD GPU cores in Linux’s Direct Rendering Infrastructure DRI is related to the improper disabling or release of resources. Exploiting this vulnerability can allow a remote attacker to cau...

ROS-20260929-73-0016

The vulnerability of the i915vmapinww function in the drivers/gpu/drm/i915/i915vma.c file of the Direct Rendering Infrastructure DRI driver in the Linux operating system is related to the occurrence of mutual locking. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260929-73-0035

The vulnerability of the dcstreamgetscanoutpos function in the drivers/gpu/drm/amd/display/dc/core/dcstream.c file of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to pointer manipulation. Exploiting this vulnerability could allow a...