漏洞公告

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Smarty Security stream restriction bypass through stream: resource

Smarty: Symlink path traversal out of trusted directories

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

h2: Duplicate Host header could facilitate request smuggling

Craft CMS: Authenticated leak of secret environment variables

Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics

Craft CMS: Incorrect path validation could potentially lead to path traversal

Craft CMS: Stored XSS in the control panel via unescaped draft name

PHP_CodeSniffer gitblame report command injection via crafted filename

node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript

node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length

ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

jsoup: Cleaner may expose markup with custom raw-text elements

Craft CMS: Arbitrary user password reset leading to administrator account takeover

Craft CMS: Authenticated RCE through Twig sandbox escape

Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

league/commonmark: Denial of service via deeply nested XML output

league/commonmark: Denial of service via colliding heading slugs