PT-2026-84695

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

Incorrect permission check in Appearance configuration page

Jenkins 2.421 through 2.579 both inclusive, LTS 2.426.1 through 2.568.2 both inclusive does not correctly perform permission checks in the Appearance configuration page added in Jenkins 2.421. This allows attackers with Overall/Manage permission to modify Appearance configuration options they...

RHEL 9 : osbuild-composer (RHSA-2026:62754)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62754 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

RHEL 8 : grafana (RHSA-2026:62407)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62407 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail:...

RHEL 9 : golang (RHSA-2026:62602)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62602 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servic...

PT-2026-84664

Name of the Vulnerable Software and Affected Versions Spark History Server versions prior to 3.5.8 Description Insufficient XSS escaping allows a malicious Spark job to generate arbitrary unescaped frontend code. This can lead to a minimal privilege escalation within the browser. Exploitation...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inpu...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the removeScripts plugin due to incomplete filtering of executable links in plugins/removeScripts.js and lib/svgo/tools.js. An attacker can execute arbitrary scripts in the context of the SVG's origin, expose...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the removeScriptElement plugin, which fails to strip SVG event attributes e.g. onclick, onload, javascript: and vbscript: scheme URLs, executable data: URLs, and srcdoc attributes inside foreignObject...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the removeScriptElement plugin, which fails to strip SVG event attributes e.g. onclick, onload, javascript: and vbscript: scheme URLs, executable data: URLs, and srcdoc attributes inside foreignObject...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via the SVG SMIL animation handling in...

CVE-2026-73524

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

EUVD-2026-69652

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of eac...

CVE-2026-73524

CVE-2026-73524 is a cross-site scripting (XSS) vulnerability in Cypht (versions before 2.12.2 ), located in the contacts module . The root cause is a flawed sanitization routine that removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact. An at...

CVE-2021-24299

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:41+00:00| seen| https://t.me/hackingAttack/9959 2026-09-02 01:03:17+00:00| seen| https://t.me/hackingAttack/9959 2026-09-08 06:00:05+00:00| published-proof-of-concept| https://t.me/hackingAttack/9959 2026-09-09 00:00:40+00:00|...

CVE-2018-18572

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:16+00:00| seen| https://t.me/hackingAttack/27119 2026-09-01 20:02:17+00:00| seen|...