CVE-2026-91852

Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Sling Xss Sling Xss Protection Api

CVE-2026-94002

Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies

Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The sshd-sftp component provides support for SFTP. The SFTP client implementation, when receiving a reply, did not check that this reply corresponded to a request sent earlier. Unsolicited replies would be stored but never consumed. A malicious server could keep sending unsolicited replies until available memory in the client was exhausted. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Mina Sshd

CVE-2026-93994

Apache MINA SSHD: Repeated-publickey policy bypass on server

Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for instance two different public keys, not just one. In OpenSSH, this would be done by setting in sshd_config AuthenticationMethods "publickey,publickey". Apache MINA SSHD provides an equivalent configuration mechanism. In Apache MINA SSHD versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 the server code in component sshd-core does not enforce that the two public keys presented are different. A user can thus successfully authenticate with only one of the two key pairs required by presenting this single key twice. This is a partial authentication bypass. Users are recommended to upgrade to version 2.20.0 or 3.0.0-M6, which fix this issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Mina Sshd

CVE-2026-91928

Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Sling Xss Sling Xss Protection Api

CVE-2026-91999

Apache Sling XSS: Improper escaping in the XSS Webconsole plugin

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Sling Xss Sling Xss Protection Api

CVE-2026-18870

This Power System update is being released to address

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1050 \(9043-mrx\) Power System E1050 \(9043-mrx\) Firmware Power System E1080 \(9080-hex\) and 50 more

CVE-2026-92001

Apache Sling XSS: Missing parser resource limits

Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Sling Xss Sling Xss Protection Api

CVE-2026-97250

WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-97279

WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-97282

WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-102313

chromium-browser: angle: chromium-browser: Information disclosure via uninitialized resource in ANGLE

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Google Microsoft

Products

Chrome Windows

CVE-2026-102314

chromium-browser: chromium-browser: UI misrepresentation in TabStrip

UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-102316

chromium-browser: chromium-browser: Use after free in Views

Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-102318

chromium-browser: chromium-browser: Out of bounds read in WebGL

Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-19492

This Power System update is being released to address

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a hypervisor call interface. An attacker with root access to a guest partition can read a limited amount of hypervisor memory, potentially exposing sensitive data belonging to the hypervisor or other guest partitions hosted on the same system, resulting in a confidentiality impact. The attacker has no control over which memory contents are returned. This vulnerability is of particular concern in multi-tenant environments where guests may run arbitrary OS images.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1050 \(9043-mrx\) Power System E1050 \(9043-mrx\) Firmware Power System E1080 \(9080-hex\) and 36 more

CVE-2026-93306

This Power System update is being released to address

IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Power System E1080 \(9080-hex\) Power System E1080 \(9080-hex\) Firmware Power System E1180 \(9080-heu\) and 16 more

CVE-2026-98000

hwmon: Fix potential UAF in pec_store

In the Linux kernel, the following vulnerability has been resolved: hwmon: Fix potential UAF in pec_store Sashiko reports: In pec_store(), a guard(mutex)(&hwdev->lock) is taken. If the chip write operation returns an error other than -EOPNOTSUPP, the code jumps to the put label, which calls put_device(hdev). If this drops the final reference, the device is freed. When the function then returns, the guard cleanup function runs and attempts to unlock the freed mutex. Use scoped_guard() instead of guard() to avoid the problem.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-98002

iommu/amd: Fix ineffective error check in nested domain allocation

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amd_iommu_pdom_id_alloc() returns an int: a domain ID on success, or the negative errno from ida_alloc_range() when the ID space is exhausted or memory is short. amd_iommu_alloc_domain_nested() stores that return value in gdom_info->hdom_id, which is a u32, and only then tests it: gdom_info->hdom_id = amd_iommu_pdom_id_alloc(); if (gdom_info->hdom_id <= 0) { The assignment discards the sign, so -ENOSPC becomes 0xffffffe4 and the test never fires. The nested domain is then set up with a host domain ID that was never allocated, instead of the allocation failing with -ENOSPC. Keep the value in an int, test it there, and store it only once it is known to be valid, which is what the other amd_iommu_pdom_id_alloc() callers already do.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-98005

erofs: delimit inode_share cache key components

In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inode_share cache key components Previously, inode_share keys were encoded as follows: fingerprint || domain_id It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won't be parsed as part of a domain ID. Change the key encoding as follows: domain_id || '\0' || fingerprint Since domain_id is a NUL-terminated string, this makes the in-memory key indices unambiguous.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-98018

net: mctp: i3c: serialize probe with bus removal

In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctp_i3c_probe() drops busdevs_lock after finding the matching bus. A concurrent I3C_NOTIFY_BUS_REMOVE can then unregister and free the bus netdev before probe passes its private data to mctp_i3c_add_device(). The latter consequently adds a list node through a freed mbus pointer. Keep busdevs_lock held until the device has been added. This also satisfies the __must_hold annotation on mctp_i3c_add_device().

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel