RLSA-2026:60306 Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...

RLSA-2026:60304 Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...

CVE-2026-5218

Softtr Informatics Technology Trading Limited Company E-Commerce Pack (before 5.03.01.49 ) is affected by an improper neutralization of script-related HTML tags (basic XSS), allowing Cross-Site Scripting in a web page. The vulnerability is rated CVSS 4.3 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:R/S...

CVE-2026-5218 HTML Injection in Softtr's E-Commerce Pack

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting XSS. This issue affects E-Commerce Pack: before 5.03.01.49...

OPENSUSE-SU-2026:21665-1 Security update for wget

This update for wget fixes the following issues: Security issued fixed: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread...

CVE-2026-47877

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

CVE-2026-47877

Spring Security Authorization Server is vulnerable to Cross-Site Scripting (XSS) in its default consent page, which renders user-controlled values without HTML entity encoding. The flaw allows an attacker to inject scripts via crafted input reflected on the consent page, requiring user interactio...

CVE-2026-47877 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

EUVD-2026-66840

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

EUVD-2026-66801

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

EUVD-2026-66773

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

SUSE CVE-2026-78961

Incorrect authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

AlmaLinux 8 : go-toolset:rhel8 (ALSA-2026:60305)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:60305 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

AlmaLinux 9 : golang (ALSA-2026:60304)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:60304 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

CVE-2026-63360

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This...

CVE-2026-15973 LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries administration page. An authenticated user with the global settings:read permission can create a survey menu entry containing attacker-controlled data. The value is stored in the...

GHSA-CRX4-7MMQ-J74J OpenSTAManager has HTML Injection in modules/utenti/edit.php

Summary An HTML Injection vulnerability exists in the user group creation functionality that allows an attacker to inject arbitrary HTML content into the application interface. The vulnerability occurs when user-supplied input in the group name field is not properly sanitized before being rendere...

DRUPAL-CONTRIB-2026-117

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting XSS vulnerability. Note: This vulnerability was fixed in 8.x-2.1 but that w...

CVE-2026-79276

A flaw was found in Google Chrome's FileSystem component. This improper privilege management vulnerability allows a remote attacker, leveraging social engineering, to bypass system access restrictions. The exploitation occurs when a user interacts with a specially crafted HTML page...

CVE-2026-79269

A flaw was found in ANGLE, a component of Chromium. A remote attacker could exploit an uninitialized resource vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to bypass the web origin policy, leading to unauthorized access to...