Improper Handling of Alternate Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Alternate Encoding in its password normalization, which applies Unicode NFKC compatibility normalization before hashing and so folds fullwidth and other compatibility characters to their ASCII equivalents. An attack...

SUSE CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

PT-2026-79324

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.15.1.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper encoding or escaping of output in the user interface occurs when using the Instance Reset Password functionality. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-73259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using...

PT-2026-79482

Name of the Vulnerable Software and Affected Versions Typemill versions prior to 2.23.0 Description Typemill is a flat-file, Markdown-based content management system for informational documentation websites. The software contains a stored HTML attribute injection flaw in the page metadata fields...

PT-2026-79428

Name of the Vulnerable Software and Affected Versions DiscordChatExporter versions prior to 2.47.2 Description HTML exports generated with markdown formatting disabled fail to perform HTML entity encoding on attacker-controlled content processed by the FormatMarkdownAsync and...

CVE-2026-63466: Improper Encoding or Escaping of Output

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-61398: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or...

Linux Distros Unpatched Vulnerability : CVE-2026-73257

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both...

PT-2026-79325

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.20.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description Improper encoding or escaping of output in the UI occurs when using the Lock User functionality, leading to a Cross-Site...

Linux Distros Unpatched Vulnerability : CVE-2026-73256

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by...

PT-2026-79346

Inappropriate Encoding for Output Context vulnerability in joshnuss xml builder XmlBuilder module allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xml builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2,...

PT-2026-79437

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domai...

CVE-2026-61399: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later,...

Linux Distros Unpatched Vulnerability : CVE-2026-63382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102089)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102089 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: xtmultiport: validate range encoding in checkentry portsmatchv1 treats any non-zero...

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the upgrader itself accep...

GHSA-8R62-W5WH-FC5M Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the upgrader itself accep...

EUVD-2026-63668

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

DEBIAN-CVE-2026-70652

libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within vipsforeignsaveuhdrsetrawhdr when a pipeline enlarges an incoming JPEG to a very large outpu...