Linux Distros Unpatched Vulnerability : CVE-2026-98310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk wal...

GHSA-QMW3-745M-W99G Backstage: Improper validation of TechDocs MkDocs configuration

Impact An attacker who can provide configuration to a TechDocs build may execute code in the generator runtime. Impact is greatest when documentation generation runs with backend credentials or host access. Patches Patched in @backstage/plugin-techdocs-node version 1.15.4. Workarounds Use externa...

CVE-2026-107214

The Excelize Go language library (versions 2.3.1 to 2.11.0 ) contains a vulnerability where the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors process attacker-controlled values. Specifically, EncryptionInfo and EncryptedPackage ...

CVE-2026-106558

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CLSA-2026-1791333440 expat: Fix of 2 CVEs

CVE-2026-66046: fix quadratic runtime in storeAtts by resolving an attribute's declared type through the default-attribute hash table instead of a linear scan of the element's default attributes - CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed...

expat: Fix of 2 CVEs

CVE-2026-66046: fix quadratic runtime in storeAtts by resolving an attribute's declared type through the default-attribute hash table instead of a linear scan of the element's default attributes - CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed...

CLSA-2026-1791333112 expat: Fix of 2 CVEs

CVE-2026-66046: fix quadratic runtime in storeAtts by resolving an attribute's declared type through the default-attribute hash table instead of a linear scan of the element's default attributes - CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed...

builder-util-runtime Electron Unauthorized Access

The vulnerability of the builder-util-runtime module of the Electron-updater software platform for creating Electron applications is related to information disclosure. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

OCaml readblock() Code Execution

The vulnerability of the readblock function in the runtime/intern.c file of the OCaml programming language is related to reading data beyond the allowed range of memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

PT-2026-107533

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs-node versions prior to 1.14.8 @backstage/plugin-techdocs-node versions prior to 1.15.6 @backstage/plugin-techdocs-node versions prior to 2.0.1 Description The @backstage/plugin-techdocs-node package improperly...

PT-2026-107664

Name of the Vulnerable Software and Affected Versions Excelize versions 2.8.0 through 2.11.0 Description An issue exists in the File.GetStyle function where the library fails to validate the lower bounds of style-table indices extracted from the styles.xml file of a workbook. Specifically, the...

PT-2026-107655

Name of the Vulnerable Software and Affected Versions github.com/xuri/excelize/v2 versions 2.0.0 through 2.11.0 github.com/xuri/excelize versions 1.1.0 through 1.4.1 Description An issue exists where the ColumnNameToNumber function accumulates a bijective base-26 value in an int64 without detecti...

PT-2026-107645

Name of the Vulnerable Software and Affected Versions Excelize versions 2.3.1 through 2.11.0 Description Insufficient structural and parameter validation occurs during the decryption dispatch process. The Decrypt function passes attacker-controlled EncryptionInfo and EncryptedPackage data into...

CVE-2026-107214: Uncaught Exception

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values...

PT-2026-107658

Name of the Vulnerable Software and Affected Versions Excelize versions 2.7.1 through 2.11.0 Description An issue exists where the mergeCellsParser function fails to perform a length check on a cached rectangle when encountering an empty ref attribute in a crafted worksheet. This empty slice is...

PT-2026-107663

Name of the Vulnerable Software and Affected Versions Excelize versions 2.1.0 through 2.11.0 Description An issue exists when processing Zip64 entries where an uncompressed size with the high bit set ranging from 2^63 through 2^64-1 is converted from a uint64 to a negative int64. This conversion...

CVE-2026-103008

A flaw was found in Elasticsearch. An authenticated user with read access to an index can trigger unbounded recursion by submitting a request defining a scripted runtime field that generates deeply nested geometry structures. Because the server does not enforce a recursion depth limit when...