vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

UBUNTU-CVE-2026-72131

In the Linux kernel, the following vulnerability has been resolved: nvme-apple: Prevent shared tags across queues on Apple A11 On Apple A11, tags of pending commands must be unique across the admin and IO queues, else the firmware crashes with "duplicate tag error for tag N", with N being the tag...

UBUNTU-CVE-2026-72006

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5stidxdata on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5stidxdata per cycle; kmemleak flags it as unreferenced...

CVE-2026-72006

The CVE-2026-72006 entry relates to the Linux kernel (net/mlx5) where the backing mlx5_st_idx_data was not freed on final deallocation, causing a memory leak in workloads that repeatedly allocate/release mkeys with TPH steering-tag hints. The root cause is that mlx5_st_dealloc_index() erases the ...

PT-2026-72195

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5 st idx data on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5 st idx data per cycle; kmemleak flags it as...

EUVD-2026-58226

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into...

CVE-2026-16770

PDF::WebKit for Perl up to version 1.2 exposes an argument-injection risk in wkhtmltopdf via meta tags (meta name="pdf-webkit-KEY"), where KEY is normalized to a --option and VALUE is passed as the argument; BUILD merges these options last, letting untrusted HTML override defaults, including opti...

CVE-2026-73262

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

CVE-2026-73262

CVE-2026-73262 – Prowler : Stored XSS in HTML reports due to unescaped cloud resource tags in the HTML output formatter (prowler/lib/outputs/html/html.py). Before 5.37.0, finding.resource_tags was inserted into reports without HTML escaping, allowing a privileged cloud principal who can modify a ...

CVE-2026-73262 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

CVE-2026-73262

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

CVE-2026-73262 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

EUVD-2026-57222

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned...

CVE-2026-73374

CVE-2026-73374 describes a stored XSS in Vulnerability-Lookup’s render_tag_badges Jinja filter. Values from containers.cna.references[].tags[] were interpolated into HTML badge markup and wrapped with MarkupSafe.Markup, bypassing Jinja escaping. An authenticated user with vulnerability:create/mod...

PT-2026-71081

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource tags, assembled by unroll dict and parse html string, into generated reports without HTML escaping, allowing a cloud principal who can modify a...

CVE-2026-72732

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discoursetemplates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discoursetemplates/templatesserializer.rb d...

CVE-2026-71848

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To...

GHSA-54FX-42GC-7VW4 Hono: Algorithmic Complexity DoS in Language Middleware

Summary The languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen-separated subtags. Details To implement progressive language-tag truncation, normalizeLanguage repeatedly calls parts.slice0...

Hono: Algorithmic Complexity DoS in Language Middleware

Summary The languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen-separated subtags. Details To implement progressive language-tag truncation, normalizeLanguage repeatedly calls parts.slice0...

CVE-2026-71848 Hono: Algorithmic Complexity DoS in Language Middleware

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To...