Unity Linux 20.1070a Security Update: poppler (UTSA-2026-099553)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099553 advisory. A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an...

PT-2026-73257

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

PT-2026-73256

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6,...

PT-2026-76810

Name of the Vulnerable Software and Affected Versions powerlevel10k affected versions not specified Description The software fails to neutralize control characters within the version field of a package.json file when rendering the package prompt segment. This allows an attacker to inject raw esca...

PT-2026-76714

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description An issue exists in the action system where an administrator can configure shell commands to run when monitoring thresholds are crossed. These commands use Mustache templates that are filled with...

CVE-2026-74794

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...

CVE-2026-74786

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

CVE-2026-74789

Scriban before 7.0.0 affected = 6.6.0 applies its LoopLimit constraint only to script loop statements and not to expensive iteration performed inside built-in operators and functions. As a result, a single expression such as 1..1000000 | array.size — or a memory-amplification expression such as '...

CVE-2026-74794

Scriban before version 6.6.0 contains an infinite recursion vulnerability in object rendering when ObjectRecursionLimit is unlimited. Attacker-supplied circular references in the template context can exhaust stack space, causing an uncatchable StackOverflowException that terminates the hosting pr...

CVE-2026-74794 Scriban before 6.6.0 Denial of Service via Infinite Recursion

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...

CVE-2026-74794 Scriban before 6.6.0 Denial of Service via Infinite Recursion

Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException...

CVE-2026-74786

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

CVE-2026-74786 Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

CVE-2026-74786 Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

EUVD-2026-59952

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

CVE-2026-74786 Scriban before 7.0.0 Denial of Service via Unbounded Template Output

Scriban before 7.0.0 affected versions = 6.6.0 contains a denial-of-service vulnerability in which the LimitToString safety limit default 1MB can be bypassed because ObjectToString resets the per-call length counter currentToStringLength on every top-level call and StringBuilderOutput enforces no...

CVE-2026-73061

Scriban before 7.2.2 has an access-modifier bypass in TypedObjectAccessor, allowing template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters and mass-assign public-setter properties, permanently alt...

CVE-2026-73061 Scriban before 7.2.2 Arbitrary Property Write via TypedObjectAccessor

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on...

CVE-2026-73057

CVE-2026-73057 affects stoatchat before 0.15.0. The vulnerability is in the SVG rendering within the proxy endpoint, where viewBox dimensions are not validated. An attacker can host malicious SVGs with extremely large width/height values and trigger concurrent requests, causing memory exhaustion ...

CVE-2026-73057 stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service

stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Attackers can host malicious SVGs with extremely large width and height values and trigger concurrent requests to exhaust available memory...