CVE-2026-103540 formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

EUVD-2026-90497

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

CLEANSTART-2026-BX15476 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

CVE-2026-32289 affects multiple packages. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. See references for individual vulnerability details...

PT-2026-103916

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description An authentication bypass exists in the '/unattended/provision' API endpoint due to a semantic logic flaw in host verifier.rb. The application checks the database state of a provisioning token...

CVE-2026-96659: Privilege Defined With Unsafe Actions

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

CVE-2026-103540: Improper Neutralization of Special Elements Used in a Template Engine

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument pagetitles leads to improper...

PT-2026-103675

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page titles leads to improper...

PT-2026-103945

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Red Hat Satellite versions 6.16 through 6.19 Description An authenticated user with low-level Viewer permissions can cause unauthorized information disclosure by submitting requests to template preview...

Rocky Linux 9 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2026_10710)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202610710 advisory. lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4800 Tenable has extracted the preceding description block directly from...

Rocky Linux 8 [CIQ] Security Update: gnutls / gnutls-c++ / gnutls-c++-debuginfo / gnutls-dane / etc Multiple Vulnerabilities (crlsa-2025_17415)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202517415 advisory. gnutls: Vulnerability in GnuTLS certtool template parsing CVE-2025-32990 gnutls: Vulnerability in GnuTLS otherName SAN export CVE-2025-32988 gnutls: NULL...

Rocky Linux 9 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2026_19167)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619167 advisory. lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-4800 Tenable has extracted the preceding description block directly from...

AlmaLinux 9.2 [TuxCare] Security Update: toolbox / toolbox-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778109988)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778109988 advisory. - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP...

Rocky Linux 8 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource Multiple Vulnerabilities (crlsa-2026_63124)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202663124 advisory. mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 encoding/asn1: golang: Go encoding/asn1: Denial of Service...

Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_70640)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202670640 advisory. buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56853 buildah: Go html/template: Cross-Site Scripting via...

Rocky Linux 10.0 [CIQ] Security Update: gnutls / gnutls-c++ / gnutls-c++-debuginfo / gnutls-dane / etc Multiple Vulnerabilities (crlsa-2025_16115)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202516115 advisory. gnutls: Vulnerability in GnuTLS certtool template parsing CVE-2025-32990 gnutls: Vulnerability in GnuTLS SCT extension parsing CVE-2025-32989 gnutls:...

CentOS Linux 7 [TuxCare] Security Update: python-virtualenv (CENTOS7:CLSA-2026:1771855894)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1771855894 advisory. - virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not...

Rocky Linux 10.2 [CIQ] Security Update: cockpit-image-builder Multiple Vulnerabilities (crlsa-2026_24331)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202624331 advisory. lodash: prototype pollution in .unset and .omit functions CVE-2025-13465 lodash: lodash: Arbitrary code execution via untrusted input in template impor...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc (crlsa-2023_3319)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20233319 advisory. golang: html/template: improper handling of JavaScript whitespace CVE-2023-24540 Tenable has extracted the preceding description block directly from the CIQ securit...

RHEL 9 : Satellite 6.18.10 Async Update (Critical) (RHSA-2026:74504)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74504 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

Rocky Linux 10.2 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_64777)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202664777 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial ...