Threats Tagged 'cve-2026-65911'

These are all security issues fixed in the python313-comfyui-frontend-package-1.52.7-1.1 package on the GA media of openSUSE Tumbleweed.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana13.1 package to address two vulnerabilities identified as CVE-2026-73088 and CVE-2026-73089. The update affects the grafana13.1 version 13.1.3-0.1.1.hum1 for aarch64 and x86_64 architectures. No detailed technical information or CVSS scores are provided for these vulnerabilities. The advisory references the availability of updated RPMs to mitigate these issues.

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.