PT-2026-97653

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform module fails to sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. This flaw allows markup from...

PT-2026-97673

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

CVE-2026-91793: Use After Free

When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free...

podman security update

5.8.2-9.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 7:5.8.2-9 - bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 - Resolves: RHEL-250818 7:5.8.2-8 - update to the latest upstream commit 66780e9b - Resolves: RHEL-240087 7:5.8.2-7 - Rebuild for golang C...

"What I See Is What I Hear": Deepfake Detection across Diverse Hearing Abilities

The proliferation of audiovisual deepfakes has lowered the cost of fraud, impersonation, and misinformation, but their success ultimately depends on human perception. Detection requires integrating auditory and visual cues, yet security and privacy research has largely overlooked d/Deaf and...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies. In some configurations, due to improper sanitisation, specially...

RHEL 9 : qt5-qtbase (RHSA-2026:70560)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70560 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security...

RHEL 9 : qt5-qtbase (RHSA-2026:70561)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70561 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security...

Oracle Linux 10 : podman (ELSA-2026-70201)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70201 advisory. - bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 - Resolves: RHEL-250818 - rebuild for CVE-2026-33810 Tenable has extracted the preceding...

RHEL 9 : qt5-qtbase (RHSA-2026:70562)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70562 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security...

Linux Distros Unpatched Vulnerability : CVE-2026-82560

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Ea...

Malicious code in @egencia/uitk-react-text (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16522 Malicious code in @egencia/uitk-react-text (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2026-85709 LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in documentroutes.py, graphroutes.py, queryroutes.py, ollamaapi.py, and lightragserver.py. The detail=stre, detail=strexc, and equivalent...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

DEBIAN-CVE-2026-63272

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to...

CVE-2026-63272

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to...

UBUNTU-CVE-2026-63272

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to...

ROOT-APP-MAVEN-CVE-2022-42889 CVE-2022-42889 in org.apache.commons:commons-text - Patched by Root

Root has patched CVE-2022-42889 in the org.apache.commons:commons-text package for Root:Maven. Multiple fixed versions available...

CVE-2026-63272 Heap buffer overflow in WMF text record import

LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately from the file and were not required to...