Linux Distros Unpatched Vulnerability : CVE-2026-100785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4,...

Linux Distros Unpatched Vulnerability : CVE-2026-100778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17,...

Linux Distros Unpatched Vulnerability : CVE-2026-100791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4,...

SUSE SLES16: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:23918-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23918-1 advisory. Update to Firefox Extended Support Release 153.3.0 ESR MFSA 2026-93, bsc1280371: - CVE-2026-92005: Use-after-free in the...

Rocky Linux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1789483713)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789483713 advisory. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS...

PT-2026-103310

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Stored HTML injection is possible through the User-Agent header. Recommendations Update to version 2026.2.18991...

RHEL 9 : python3.12-lxml (RHSA-2026:74082)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:74082 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Linux Distros Unpatched Vulnerability : CVE-2026-100772

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4,...

RHEL 9 : python3.9 (RHSA-2026:74088)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74088 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

PT-2026-103466

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Page Forms extension allows Stored XSS. This issue affects MediaWiki Page Forms extension: 1.46, 1.45, and 1.43...

PT-2026-103624

Name of the Vulnerable Software and Affected Versions MediaWiki MediaSearch extension versions 1.43, 1.45, and 1.46 Description Improper neutralization of script-related HTML tags in a web page leads to a Cross-Site Scripting XSS issue. XSS is a flaw that allows an attacker to inject malicious...

CVE-2026-100263: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible...

CVE-2026-89193: Improper Neutralization of Input During Web Page Generation

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scriptin...

Linux Distros Unpatched Vulnerability : CVE-2026-100774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4,...

Linux Distros Unpatched Vulnerability : CVE-2026-100811

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17,...

CVE-2026-103444: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS. This issue affects MediaWiki WikiForum extension: master...

PT-2026-103037

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scriptin...

Linux Distros Unpatched Vulnerability : CVE-2026-100780

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4,...

Rocky Linux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1780498704)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780498704 advisory. - http.cookies.Morsel.jsoutput returns an inline snippet and only escapes for JavaScript string context. It does not neutralize the HTML...

AlmaLinux 9.2 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / etc (ALMALINUX9.2:CLSA-2026:1789583130)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789583130 advisory. - Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS...