GHSA-3HVR-PHFH-X26G vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-azure...

CVE-2026-66460

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

CVE-2026-70466

creationtimestamp| type| source ---|---|--- 2026-08-13 14:00:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3msxsk3fzpf2l...

CVE-2026-66460 WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

CVE-2026-66460

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

CVE-2026-66460

CVE-2026-66460 affects the WordPress AfterShip Tracking plugin for WooCommerce, version

EUVD-2026-57879

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

CVE-2026-66460 WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

CVE-2026-66460: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

Linux Kernel Net Scheduler Connection Tracking Race Condition Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of...

PT-2026-71566

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

EUVD-2026-57626

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

CVE-2026-57858 Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

CVE-2026-57858

CVE-2026-57858 affects Cal.com Cal.diy (versions 2.1.1–6.2.0). The stored XSS arises in BookingPageTagManager through an unsanitized analytics tracking ID, allowing an authenticated event owner to inject JavaScript that can run in visitors’ browsers. Reported impact includes potential session coo...

CVE-2026-57858 Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

CVE-2026-18663

A flaw was found in 389-ds-base. The getldapmessagecontrolsext function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPIREQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An...

CVE-2026-18663

A flaw was found in 389-ds-base. The getldapmessagecontrolsext function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPIREQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An...

CVE-2026-18663

The CVE-2026-18663 entry concerns 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot, leading to a double-free when teardown frees the same pointer agai...

CVE-2026-18663

A flaw was found in 389-ds-base. The getldapmessagecontrolsext function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPIREQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An...