PT-2026-129146

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and...

Linux Distros Unpatched Vulnerability : CVE-2026-118013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118013 Note th...

Linux Distros Unpatched Vulnerability : CVE-2026-116687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-sit...

Linux Distros Unpatched Vulnerability : CVE-2026-118016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118016 Note that Nessus relies on th...

CVE-2026-118660: Server-Side Request Forgery (SSRF)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading...

Linux Distros Unpatched Vulnerability : CVE-2026-117901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-117929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-117951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...

Linux Distros Unpatched Vulnerability : CVE-2026-117960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-112356: Improper Neutralization of Input During Web Page Generation

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

CVE-2026-118244: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a...

PT-2026-130575

This module enables you to use AI on the website. The module does not sufficiently restrict HTML rendering, allowing cross-site scripting XSS under certain conditions. This vulnerability is mitigated by the fact that an attacker must have access to a text format that can render HTML...

CVE-2026-118035: Progress Software Telerik Document Processing Libraries: In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient…

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF...

Improper output handling vulnerability in intlify vue-i18n

A security vulnerability exists in intlify Vue-i18n versions 9.14.5, 10.0.8, 11.1.10 through 11.4.14, and 12.0.0-alpha.4 through 12.0.0-alpha.5. This vulnerability arises because sanitizeTranslatedHtml fails to disable the srcdoc attribute of iframes; as a result, browsers parse the srcdoc conten...

Skia graphics library DoS

The vulnerability in the Skia graphics library of Google Chrome and Microsoft Edge is related to insufficient validation of unusual or exceptional states. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service by using a specially crafted HTML page...

Skia graphics library Protected Information Access

The vulnerability in the Skia graphics library of Google Chrome and Microsoft Edge is related to insufficient validation of unusual or exceptional states. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information via a specially crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-118015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159. CVE-2026-118015 Note that Nessus relies on th...

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266

This module enables you to use AI on the website. The module does not sufficiently restrict HTML rendering, allowing cross-site scripting XSS under certain conditions. This vulnerability is mitigated by the fact that an attacker must have access to a text format that can render HTML...

PT-2026-129123

Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling escapeParameter, called escapeParameterHtml in the Legacy API, does not escape named interpolation values when the same translation call supplies both list and named values because...

Linux Distros Unpatched Vulnerability : CVE-2026-117881

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and...