ALSA-2026:65153 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: net/mail:...

AlmaLinux 9 : grafana-pcp (ALSA-2026:63136)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:63136 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

PT-2026-88337

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages, no...

ALSA-2026:65117 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 mime: golang:...

Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 mime: golang:...

CVE-2026-85630: Improper Neutralization of Input During Web Page Generation

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value th...

CVE-2026-78741: Improper Neutralization of Input During Web Page Generation

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS in the wysiwyg-CKEditor image upload feature...

CVE-2026-78738: Improper Neutralization of Input During Web Page Generation

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...

AlmaLinux 8 : xmlrpc-c (ALSA-2026:64772)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:64772 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from the...

CVE-2026-84820: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...

CVE-2026-63523: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-64838: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

Linux Distros Unpatched Vulnerability : CVE-2026-19872

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and...

Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

CVE-2026-86644: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file websrc/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The explo...

RHEL 9 : ignition (RHSA-2026:65359)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65359 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing fil...

ALSA-2026:65116 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 mime: golang:...

PT-2026-87396

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

PT-2026-88288

Improper neutralization of input during web page generation 'cross-site scripting' in Skype for Business allows an unauthorized attacker to perform spoofing over a network...

PT-2026-88400

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...