Rocky Linux 9 [CIQ] Security Update: java-17-openjdk / java-17-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_1879)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20231879 advisory. OpenJDK: improper connection handling during TLS handshake 8294474 CVE-2023-21930 OpenJDK: Swing HTML parsing issue 8296832 CVE-2023-21939 OpenJDK: incorre...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-3.1 / aspnetcore-targeting-pack-3.1 / etc Multiple Vulnerabilities (crlsa-2022_2202)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20222202 advisory. dotnet: excess memory allocation via HttpClient causes DoS CVE-2022-23267 dotnet: malicious content causes high CPU and memory usage CVE-2022-29117 dotnet:...

CLEANSTART-2026-MR80646 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the containerd package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-AJ28533 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the containerd package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CLEANSTART-2026-KC55960 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the minio-operator package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-DE66798 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the minio-operator package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

Rocky Linux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1789657645)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789657645 advisory. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS...

AlmaLinux 9.2 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / etc (ALMALINUX9.2:CLSA-2026:1789583130)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789583130 advisory. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS...

AlmaLinux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1789657645)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789657645 advisory. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS...

AlmaLinux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1789483713)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789483713 advisory. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS...

Rocky Linux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1789483713)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789483713 advisory. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS...

CLEANSTART-2026-MN47589 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...

CLEANSTART-2026-HE86842 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

CVE-2026-42506 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

CVE-2026-79320: Improper Neutralization of Input During Web Page Generation

Stencil core 4.43.5 contains a DOM-based cross-site scripting XSS vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes t...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

image-builder security update

An update is available for image-builder. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A local binary for building customized OS artifacts such as VM images a...

CVE-2026-92022

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...