1140295 matches found
golang security, bug fix, and enhancement update
An update is available for golang. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The golang packages provide the Go programming language compiler. Security...
RLSA-2026:60306 Important: golang security, bug fix, and enhancement update
The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...
RLSA-2026:60304 Important: golang security, bug fix, and enhancement update
The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...
CVE-2026-73426
A flaw was found in Trix, a rich text editor. An attacker can exploit a cross-site scripting XSS vulnerability by crafting malicious HTML with a data-trix-serialized-attributes attribute. This attribute can bypass the DOMPurify sanitizer, allowing the execution of arbitrary JavaScript in a user's...
CVE-2026-75838
A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...
CVE-2026-73427
A flaw was found in Trix, a rich text editor. A remote attacker could exploit this vulnerability by convincing a victim to drag and drop a specially crafted JSON payload into an editor using the Level0InputController. This could bypass sanitization and allow the injection of executable JavaScript...
vulnerabilities present in Microsoft Office
Microsoft has identified vulnerabilities in various Office products. A malicious individual can exploit these vulnerabilities to carry out attacks that can cause damage as described in the following table. For successful exploitation, the malicious individual must deceive the victim into opening ...
CVE-2026-78289
Unauthenticated Cross Site Scripting XSS in CozyStay = 1.10.0 versions...
CVE-2026-78293
Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...
CVE-2026-78261
Unauthenticated Cross Site Scripting XSS in Realtyna Organic IDX plugin = 5.4.1 versions...
CVE-2026-78273
Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-78281
Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...
CVE-2026-78283
Unauthenticated Cross Site Scripting XSS in Music Player for WooCommerce = 1.8.9 versions...
CVE-2026-59354
In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...
CVE-2026-78293 WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...
CVE-2026-78293 WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...
EUVD-2026-66947
Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...
CVE-2026-78293
CVE-2026-78293 affects the WordPress plugin WP w3all phpBB (versions ≤ 3.0.6 ), where an unauthenticated Cross Site Scripting (XSS) vulnerability was identified. The issue was discovered by lanlv – HPT Vietnam Corporation and reported via Patchstack. The CVSS 3.1 score is 7.1 (HIGH) with vector A...