CVE-2026-36472: Improper Neutralization of Input During Web Page Generation

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS. Improper neutralization of the referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msginfo...

PT-2026-105287

TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.0.3-tuxcare.3...

SUSE SLED15 / SLES15 Security Update : perl-URI (SUSE-SU-2026:4046-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4046-1 advisory. This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punyco...

Linux Distros Unpatched Vulnerability : CVE-2026-93751

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII...

PT-2026-96129

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Cross Site Scripting XSS occurs due to improper neutralization of the referer value. A remote attacker can execute arbitrary JavaScript within the session of an authenticated user by using a javascript: URI,...

Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16751)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16751 advisory. - In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and UR...

Linux Distros Unpatched Vulnerability : CVE-2026-93690

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode...

SUSE SLES12 Security Update : perl-URI (SUSE-SU-2026:4070-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4070-1 advisory. This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to...

Linux Distros Unpatched Vulnerability : CVE-2026-93600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI...

PDF_XSS

Payloads All The PDFs A list of crafted malicious PDF files...

CVE-2026-15463 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-15463

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress (versions up to and including 4.7.42 ) is vulnerable to Reflected Cross-Site Scripting via the host parameter (the CVELIST title also references a uri parameter). The root cause is insufficient input sanitization and o...

CVE-2026-15463 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

PT-2026-95900

Name of the Vulnerable Software and Affected Versions Comfast CF-N1-S version 2.6.0.1 Description The Web Management Interface contains a stack-based buffer overflow that can be triggered remotely. The issue exists within the get css path from uri function located in the /cgi-bin/mbox-config...

Improper Encoding or Escaping of Output

Overview uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars, which decodes invalid and overlong percent-encoded sequences in...

CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

DEBIAN-CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

UBUNTU-CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-93751 uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...