Dmitrijs Trizna

**Name of the Vulnerable Software and Affected Versions** Wireshark versions 4.6.0 through 4.6.6 Wireshark versions 4.4.0 through 4.4.16 **Description** A crash in the SSH protocol dissector allows a denial of service. **Recommendations** Update Wireshark versions 4.6.0 through 4.6.6 to a newer version. Update Wireshark versions 4.4.0 through 4.4.16 to a newer version.

**Name of the Vulnerable Software and Affected Versions** ALSA library versions prior to 1.2.16.1 **Description** A double-free issue exists in the `parse def()` function within `src/conf.c`. This occurs when the system parses nested compound or array configuration blocks and fails to check return values before proceeding. Consequently, the `snd config delete()` function is called twice on the same already-freed node, which can lead to memory corruption, a NULL-pointer write, or an invalid memory read if an attacker provides maliciously crafted ALSA configuration text. **Recommendations** Update ALSA library to version 1.2.16.1.

**Name of the Vulnerable Software and Affected Versions** Drupal core versions 11.3.0 through 11.3.6 **Description** Drupal core contains an issue where entity suggestions provided during the process of adding a link to CKEditor 5 are not sufficiently sanitized. This allows a malicious user to trigger a stored cross-site scripting (XSS) attack against other users. Cross-site scripting is a flaw where an application includes untrusted data in a web page without proper validation, allowing attackers to execute malicious scripts in the victim's browser. **Recommendations** Update to version 11.3.7.