Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ip...

CVE-2026-94684: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection...

PT-2026-97464

Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certain site...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, th...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies. In some configurations, due to improper sanitisation, specially...

PT-2026-97522

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.0.6 through 7.2.0 Description An authenticated actor with system set permission can perform a stored cross-user cross-site scripting XSS attack. By sending a request to the 'POST /openc3-api/screen' endpoint, an attack...

CVE-2026-95530: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...

CVE-2026-95515: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...

CVE-2026-94682: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...

CVE-2026-94671: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

CVE-2026-94500: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...

CVE-2026-94461: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...

CVE-2026-94391: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate FAQ = 2.4.14 versions...

CVE-2026-94176: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.4.1 versions...

CVE-2026-94168: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-94118: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Blocks – Gutenberg Blocks for WordPress = 2.3.17 versions...

CVE-2026-95957: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote...

CVE-2026-91999: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91928: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...