CVE-2026-11757

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...

EUVD-2026-82771

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...

CVE-2026-11757 Reflected XSS in KA Informatics' Bar Association Website

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...

CVE-2026-11757

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the KA Informatics Technologies Ltd. Co. Bar Association Website , caused by improper neutralization of input during web page generation. The affected version range extends through 18/09/2026 . The CVSS 3.1 score is 6.1 (MEDIUM) , wit...

CVE-2026-11757 Reflected XSS in KA Informatics' Bar Association Website

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...

CVE-2026-79954 NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand TC receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the...

CVE-2026-11757: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...

CVE-2026-90113

CVE-2026-90113 is a slab-use-after-free vulnerability in the Linux kernel's netdevsim (network device simulator) driver. The root cause is that nsim_queue_start() failed to update the queue-to-NAPI mapping via netif_queue_set_napi() when a new receive queue was swapped in during a queue reset. Th...

CVE-2026-90016 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwrestructwmmie rtwrestructwmmie scans inie for a WMM IE with: while i inlen ... if i + 5 inlen && iniei == 0xDD && ... ... break; i += iniei + 1 + 2; / to the next IE element / When the "i + ...

CVE-2026-68534 Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...

CVE-2026-68534 Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...

CVE-2026-68534 Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors

Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenticated attacker could submit a payload through a public Express Form; it then executed in an administrator's dashboard session when the...

CVE-2026-68534

Concrete CMS before 9.5.3 contained a stored cross-site scripting (XSS) vulnerability caused by Express entry labels being rendered as raw HTML in association selectors. An unauthenticated attacker could submit a malicious payload through a public Express Form, which would then execute in an admi...

CVE-2026-81898

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

CVE-2026-81898 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

CVE-2026-81898 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

EUVD-2026-78900

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

CVE-2026-81898

In Concrete CMS below version 9.5.3 , the Address attribute's country-less text formatter skipped HTML-escaping, enabling a stored XSS in Express association views. A low-privilege user able to submit an Address attribute with a blank (non-required) country field could inject script that executes...

CVE-2026-55770 OpenBao: LDAPi ldaputil (wrong escape func)

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping function, where RFC 4515 LDAP search-filter escaping was required in sdk/helper/ldaputil/client.go GetUserDN. With the LDAP authentication...

PT-2026-92180

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...