CVE-2026-94176: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.4.1 versions...

CVE-2026-95515: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...

ALSA-2026:70564 Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ip...

PT-2026-97467

Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...

PT-2026-97484

Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...

H5P Nodejs Library 10.0.4 Cross Site Scripting

Lumi Education h5p-nodejs-library versions through 10.0.4 contain a cross site scripting vulnerability due to insufficient validation of files contained in uploaded H5P content. An attacker can upload content containing malicious JavaScript that executes in another user's browser when the affecte...

PT-2026-97189

Name of the Vulnerable Software and Affected Versions JSM Show Post Metadata WordPress plugin versions prior to 4.9.1 Description Insufficient escaping of a post meta key before it is output into an inline event-handler attribute within an admin-facing meta box allows users with contributor-level...

RockyLinux 9 : containernetworking-plugins (RLSA-2026:70391)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70391 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial o...

AlmaLinux 10 : podman (ALSA-2026:70201)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70201 advisory. podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 podman: Go net/http: Unencrypted HTTP/2...

PT-2026-97522

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.0.6 through 7.2.0 Description An authenticated actor with system set permission can perform a stored cross-user cross-site scripting XSS attack. By sending a request to the 'POST /openc3-api/screen' endpoint, an attack...

RHEL 9 : containernetworking-plugins (RHSA-2026:70391)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:70391 advisory. The Container Network Interface CNI project consists of a specification and libraries for writing plug- ins for configuring network...

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ip...

Important: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-88415

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...

CVE-2026-75684

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

CVE-2026-93981

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

EUVD-2026-84790

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page...

EUVD-2026-84780

Adobe Connect is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...