Rocky Linux 9 [CIQ] Security Update: python3-tbb / python3-tbb-debuginfo / tbb / tbb-debuginfo / etc (crlsa-2025_1210)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251210 advisory. jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 Tenable has extracted the preceding description block directly fr...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2026:1780400093)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780400093 advisory. - http.cookies.Morsel.jsoutput returns an inline snippet and only escapes for JavaScript string context. It does not neutralize the HTML...

Rocky Linux 9 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc (crlsa-2026_41949)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202641949 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: python3-tbb / python3-tbb-debuginfo / tbb / tbb-debuginfo / etc (crlsa-2025_1215)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251215 advisory. jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 Tenable has extracted the preceding description block directly fr...

Rocky Linux 8 [CIQ] Security Update: delve / delve-debuginfo / delve-debugsource / go-toolset / golang / etc (crlsa-2023_3319)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20233319 advisory. golang: html/template: improper handling of JavaScript whitespace CVE-2023-24540 Tenable has extracted the preceding description block directly from the CIQ securit...

Rocky Linux 10.2 [CIQ] Security Update: image-builder / image-builder-debuginfo / image-builder-debugsource Multiple Vulnerabilities (crlsa-2026_67139)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667139 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_62407)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202662407 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_70640)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202670640 advisory. buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56853 buildah: Go html/template: Cross-Site Scripting via...

EUVD-2026-83586

hono/jsx renders plain strings unescaped in boundary components, leading to XSS...

CVE-2026-103584

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting XSS. This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

Important: Red Hat Security Advisory: python3.9 security update

An update for python3.9 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

CLSA-2026-1790802024 skopeo: Fix of 4 CVEs

rebuild with newer golang 1.22.9-1.el92.tuxcare.els26 to fix the following Go standard-library CVEs - CVE-2026-33818: encoding/asn1: enforce a maximum recursion depth in parseField and parseSequenceOf, so a deeply nested crafted DER payload can no longer exhaust the stack while unmarshalling -...

CLSA-2026-1790800048 containernetworking-plugins: Fix of 4 CVEs

rebuild with newer golang 1.22.9-1.el92.tuxcare.els26 to fix the following Go standard-library CVEs - CVE-2026-33818: encoding/asn1: enforce a maximum recursion depth in parseField and parseSequenceOf, so a deeply nested crafted DER payload can no longer exhaust the stack while unmarshalling -...

chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia

An inappropriate implementation flaw was found in Skia in Google Chrome. This issue may allow a remote attacker to compromise the renderer process to perform a sandbox escape via a crafted HTML page...

chromium-browser: skia: chromium-browser: skia: Arbitrary code execution via crafted HTML page

A flaw was found in Skia, a 2D graphics library. A remote attacker, who has already compromised the renderer process, could exploit a use-after-free vulnerability by providing a specially crafted HTML page. This could lead to the execution of arbitrary code within the sandbox environment,...

chromium-browser: angle: Use after free in ANGLE

Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Critical...

chromium-browser: angle: ANGLE: Remote code execution via crafted HTML page

A flaw was found in ANGLE, a component used in Google Chrome. A remote attacker could exploit an out-of-bounds write vulnerability by tricking a user into visiting a specially crafted HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security...

chromium-browser: angle: ANGLE Out-of-Bounds Write Vulnerability

A flaw was found in chromium-browser. An out-of-bounds write vulnerability exists within the ANGLE graphics component, allowing a remote attacker to trigger out-of-bounds memory access by providing a specially crafted HTML page. This allows an attacker to potentially manipulate memory contents. T...