Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1981)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1981 advisory. A use-after-free / double-free in c-ares' query-completion handling. Thesame flaw -- a query's callback being invoked while the query is stilllinked in the channel's internal lookup structures -- is...

ROS-20260720-73-0070

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...

ALSA-2026:42088 Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...

PT-2026-61578

SurrealDB before v2.6.1 and before v3.0.0-beta.3 contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability disabled by default. Any user able to execute arbitrary queries — including unauthenticated guests when...

CVE-2026-26483

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...

CVE-2026-26483

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...

EUVD-2026-46050

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...

PT-2026-61540

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

CVE-2026-35198: Improper Neutralization of Input During Web Page Generation

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting XSS vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through...

CVE-2026-44230: Improper Neutralization of Input During Web Page Generation

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

ALSA-2026:42062 Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...

MiracleLinux 9 : thunderbird-140.11.0-1.el9_8.ML.1 (AXSA:2026-1278:16)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1278:16 advisory. firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component CVE-2026-8388 firefox: Other issue in the JavaScript Engine component...

RHEL 9 : webkit2gtk3 (RHSA-2026:42062)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42062 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

RHEL 8 : webkit2gtk3 (RHSA-2026:42088)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42088 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

CVE-2026-2445: Improper Neutralization of Input During Web Page Generation

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

ROS-20260720-73-0074

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the ability to utilize memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-12228

A stored cross-site scripting XSS vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms latest version. The endpoint stores attacker-controlled promptcontent into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message DM thread,...

EUVD-2026-45401

A stored cross-site scripting XSS vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms latest version. The endpoint stores attacker-controlled promptcontent into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message DM thread,...

CVE-2026-12228

The CVE describes a stored XSS in parisneo/lollms via POST /api/prompts/share where attacker-controlled prompt_content is saved to DBDirectMessage.content and later rendered with v-html in the DM UI. The frontend regex-based sanitizer fails to fully sanitize HTML, enabling malicious payloads to r...