PT-2026-95377

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.9.1 Description The polyglot script sandbox contains an incomplete deny-list within com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED. While java.util.ResourceBundle is listed, the filter uses exact equalit...

Linux Distros Unpatched Vulnerability : CVE-2026-92973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets...

CVE-2025-53837: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

CVE-2026-92991: Improper Neutralization of Input During Web Page Generation

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘displayid’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that wil...

EulerOS Virtualization 2.11.0 : samba (EulerOS-SA-2026-3558)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Upstream Security Advisories: https://www.samba.org/samba/security/CVE-2007-2447.html...

EulerOS Virtualization 2.11.1 : samba (EulerOS-SA-2026-3471)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Upstream Security Advisories: https://www.samba.org/samba/security/CVE-2007-2447.html...

Fedora 43 : sblim-cmpi-base (2026-fe1549bec3)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fe1549bec3 advisory. Use mktemp for temporary files in provider registration script CVE-2026-73585 Tenable has extracted the preceding description block directly from th...

EulerOS Virtualization 2.12.0 : samba (EulerOS-SA-2026-3672)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...

EulerOS Virtualization 2.12.1 : samba (EulerOS-SA-2026-3618)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...

Fedora 44 : sblim-cmpi-base (2026-7510dd645d)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7510dd645d advisory. Use mktemp for temporary files in provider registration script CVE-2026-73585 Tenable has extracted the preceding description block directly from th...

EulerOS 2.0 SP10 : samba (EulerOS-SA-2026-3769)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the 'pri...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 < Security 2026 Update 3 Multiple XSS

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, or 11.5 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by multiple vulnerabilities: - A reflected cross site scripting vulnerability exists in Esri Portal for ArcGIS which may allow a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption cue text process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious content into closed captions. Details Cross-site scripting or XSS is a code...

Cross-site Scripting (XSS)

Overview @asicupv/paella-core is a Multi stream HTML video player Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption cue text process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious content into close...

CVE-2026-2585

The Brizy – Page Builder WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the rootAttributes parameter in versions up to and including 2.8.14 , caused by insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level or higher access c...

Malicious code in test89078-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1ac938360c682e2489d11de9278697e7e2e85d73c612d2ab60ed28553bb5573 The package's preinstall script scripts.preinstall = 'node index.js' runs automatically on npm install and collects os.userInfo.username and...

@platejs/core HTML deserialization can trigger browser behavior during parsing

Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes. Applications that deserialize HTML from untrusted or cross-user...

GHSA-QRFJ-MGW8-J9C6 @platejs/core HTML deserialization can trigger browser behavior during parsing

Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes. Applications that deserialize HTML from untrusted or cross-user...

EUVD-2026-80782

@platejs/core HTML deserialization can trigger browser behavior during parsing...

Improper Encoding or Escaping of Output

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via improper handling of...