CVE-2026-116675

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

CVE-2026-104067

Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code...

CVE-2026-104066

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing...

CVE-2026-104063

Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leading to crashes or heap...

CVE-2026-104061

Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloaderpsd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code...

CVE-2026-104064

Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloadertiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting...

CVE-2026-104065

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...

CVE-2026-104062

Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing ...

CVE-2026-99217

In the Linux kernel, the following vulnerability has been resolved: fork: release the files of a failed fork after schedcancelfork Reorder copyprocess cleanup so schedfork taking scxforkrwsem scxprefork is safe and isn't held around exiting files. Right now, a fork that fails while another thread...

CVE-2026-99240

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damoscommitquotagoal for zero targetvalue Patch series "mm/damon: move zero damos quota targetvalue handling to the core layer". Having zero DAMOS quota target value can cause division by zero. DAMON API...

CVE-2026-99239

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...

CVE-2026-99235

In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram createfieldvarhist creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: histdata =...

CVE-2026-99233

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Verify eventcall identity when updating synthevent refcount In eventhisttriggerparse and histunregall, the histogram registration and unregistration paths look up findsynthevent using...

CVE-2026-99232

In the Linux kernel, the following vulnerability has been resolved: tracing/syscalls: Use copyfromuser for the faultable syscall buffer syscallcopyuserarray copies the buffer argument of faultable syscalls write, pwrite64, ... with copyfromuser, which skips accessok. Use copyfromuser instead so a...

CVE-2026-99231

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: own the request before clearing -head iowaitidremovewq only takes the wait queue lock if -head is set. iowaitidwait clears -head first thing, before it tries to become the owner of the request by bumping -refs. If...

CVE-2026-99230

In the Linux kernel, the following vulnerability has been resolved: iouring/cmd: don't leave list poison in -hashnode iouringcmddelcancelable uses hlistdel to take a command off -cancelableuringcmd, which leaves LISTPOISON1/2 behind in -hashnode. Requests are recycled through the request cache...

CVE-2026-99229

In the Linux kernel, the following vulnerability has been resolved: iouring/wait: don't spin on a stuck overflow list As long as IOCHECKCQOVERFLOWBIT is set, iocqringwaitschedule returns right away, before it gets to look at signals or arms the timeout, for iocqringwait to flush the overflow list...

CVE-2026-99227

In the Linux kernel, the following vulnerability has been resolved: iouring/waitid: prevent cancel reference wrap iowaitid packs the cancellation state into bit 31 of -refs and uses bits 30:0 as a 31-bit reference counter: define IOWAITIDCANCELFLAG BIT31 define IOWAITIDREFMASK GENMASK30, 0...

CVE-2026-99226

In the Linux kernel, the following vulnerability has been resolved: keys: Avoid the owner account dereference in named keyring lookup Named keyring lookup must keep the storage containing the owner UID alive through the namespace mapping check. findkeyringbyname reads keyring-user-uid under...

CVE-2026-99224

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the type name while describing a key keyctldescribekey must keep the key type's name alive until kasprintf has consumed it. The retained key reference keeps the key and its description alive, but does not pin the...

CVE-2026-99223

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring indexes independent of kernel addresses KEYCTLREAD returns the serial numbers in a keyring in associative-array traversal order. The first word of the index is a public, deterministic hash of the type pointer,...

CVE-2026-99219

In the Linux kernel, the following vulnerability has been resolved: ftrace: Initialize modname and offset in printrec printrec leaves 'modname' and 'offset' uninitialized and kallsymslookup only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname'...

CVE-2026-99241

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidatelock in ntfsfilemappagemkwrite ntfsfilemappagemkwrite calls iomappagemkwrite without holding mapping-invalidatelock, so a concurrent truncate or fallocate can be in the middle of invalidating pagecache and...

CVE-2026-99238

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when updating modules in persistent instances tracemodulerecord walks ftracetracearrays from the module notifier without tracetypeslock. A concurrent rmdir of an instance removes it from the list and...

CVE-2026-99237

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when resetting last boot data from readers updatelastdataifempty is called from tracingopen with OTRUNC, tracingreadpipe and tracingbuffersread without tracetypeslock. Two readers can both pass the...

CVE-2026-99236

In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicateparse's inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an...

CVE-2026-99234

In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist registers a second hist trigger on that event to provide it,...

CVE-2026-99228

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't lose the signal that ends work When a thread exits, only its tracked requests are cancelled. Then its io-wq is torn down. iowqexitworkers signals every worker, to get it out of an interruptible sleep, and wai...

CVE-2026-99220

In the Linux kernel, the following vulnerability has been resolved: asymmetrickeys: reject trust keys without IDs The PKCS8 parser deliberately leaves the asymkeyids payload slot empty. keyorkeyringcommon unconditionally dereferences that slot when a PKCS8 key is supplied to a keyorkeyring...

CVE-2026-99221

In the Linux kernel, the following vulnerability has been resolved: keys/trustedkeys: return immediately after TPM unseal failure trustedtpmunseal proceeds to pcrlock when the TPM unseal operation fails. If pcrlock succeeds, its return value overwrites the unseal error, causing key instantiation ...

CVE-2026-99225

In the Linux kernel, the following vulnerability has been resolved: keys: Check the authorization payload in process keyring searches An authorization payload and its saved credentials must remain valid while searchprocesskeyringsrcu searches the requestor's keyrings. The function validates the...

CVE-2026-99222

In the Linux kernel, the following vulnerability has been resolved: keys: Protect the read method check against type removal keyctlreadkey checks key-type-read without holding key-sem. A reference keeps the key alive, but does not pin the module containing its type. A surviving RxRPC key can...

CVE-2026-99218

In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish releases the parked threads by clearing -task in their corethread entry and calling wakeupprocess on each of them. It does that without holding a reference on the...

CVE-2026-99242

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidatelock for punch hole, collapse range, and insert range operations. For standard allocation modes mode == 0, FALLOCFLKEEPSIZE, the lo...

CVE-2026-65059

Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request...

CVE-2025-47935

Multer is a node.js middleware for handling multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream...

CVE-2025-47944

Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service DoS by sending a malformed multi-part upload request. This request causes an unhandled...

CVE-2026-3520

Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service DoS by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No...

CVE-2026-5079

Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of...

CVE-2026-88932

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...

CVE-2025-48997

Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service DoS by sending an upload file request with an empty string field name. This request causes ...

CVE-2026-113872

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is...

CVE-2026-3304

Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service DoS by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch...

CVE-2026-5038

Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe call does not propagate the stream destroy signal to the...

CVE-2026-77037

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...

CVE-2026-82333

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A larg...

CVE-2025-7338

Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service DoS by sending a malformed multi-part upload request. This request causes an unhandled...

CVE-2026-2359

Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service DoS by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to...

CVE-2026-77063

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. A...

CVE-2026-77078

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError Invalid array length that terminates the Node.js process. The first field uses a very large numeric array index to...