EUVD-2026-70875

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may b...

CVE-2026-85382

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialcharsdecode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a...

Important: Red Hat Security Advisory: container-tools:rhel8 security update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

EUVD-2026-70855

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialcharsdecode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a...

CVE-2026-85382 light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialcharsdecode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a...

CVE-2026-85382 light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialcharsdecode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a...

CVE-2026-85382

A cross-site scripting (XSS) vulnerability exists in light0011 cms (identified by commits c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930), specifically in the Chapter Content Output component. The htmlspecialchars_decode function in the file App/Home/View/Defaul...

AlmaLinux 9 : grafana (ALSA-2026:62406)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62406 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

RockyLinux 10 : grafana (RLSA-2026:63022)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:63022 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service vi...

The vulnerability of the Element.setAttribute() method in the XML Document Access and Management Module XMLDOM allows a attacker to perform cross-site scripting (XSS) attacks.

The vulnerability of the Element.setAttribute method in the XML document access and manipulation module XMLDOM is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2026-38961

Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...

PT-2026-85527

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...

RockyLinux 8 : container-tools:rhel8 (RLSA-2026:63163)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:63163 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 encoding/asn1: golang: Go encoding/asn1: Denial of...

PT-2026-85509

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

EUVD-2026-71609

Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...

EUVD-2026-71610

Cross Site Scripting vulnerability in Netgate pfSense Plus software versions = 26.03 pfSense CE software versions = 2.8.1 allows a remote attacker to execute arbitrary code via the captiveportalstatus.widget.php file...

CVE-2026-78849

A Cross-Site Scripting (XSS) vulnerability in Netgate pfSense Plus ≤ 26.03 and pfSense CE ≤ 2.8.1 allows a remote attacker to execute arbitrary code via the captive_portal_status.widget.php file. The CISA SSVC assessment rates exploitation as PoC , not automatable , with partial technical impact....

PT-2026-85475

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. This issue affects Menulux Portal: before 20260903211448...

RHEL 8 : grafana-pcp (RHSA-2026:63124)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:63124 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...