CVE-2026-100694

A flaw was found in Hugo. When processing content files mapped to the Org Mode media type, Hugo renders raw HTML export blocks and snippets without proper escaping. An attacker who can influence or supply content files can exploit this vulnerability to conduct cross-site scripting XSS, executing...

CVE-2026-82326

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...

CVE-2026-82326 HTML Injection in Enocta Educational's Enocta Platform

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...

CVE-2026-82326

The Enocta Platform by Enocta Educational Technologies Inc. is vulnerable to a cross-site scripting (XSS) flaw due to improper neutralization of input during web page generation. Specifically, the vulnerability allows for XSS targeting HTML attributes . The impact is categorized as LOW for integr...

EUVD-2026-88240

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...

CVE-2026-82326 HTML Injection in Enocta Educational's Enocta Platform

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...

CVE-2026-87752

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

CVE-2026-87752

A cross-site scripting (XSS) vulnerability exists in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis due to improper neutralization of input during web page generation. This flaw specifically allows XSS Targeting HTML Attributes . The vulnerability affects versions f...

EUVD-2026-88222

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

CVE-2026-87752 HTML Injection in Rolantis Information Technologies' Agentis

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

CVE-2026-87752 HTML Injection in Rolantis Information Technologies' Agentis

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

CLSA-2026-1790588952 podman: Fix of 5 CVEs

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els26 to fix the following Go standard-library CVE's - CVE-2026-33818: encoding/asn1: enforce a maximum recursion depth in parseField and parseSequenceOf, so a deeply nested crafted DER payload can no longer exhaust the stack while...

CVE-2026-91204 Apache Roller: Stored javascript: URI in HTML comments

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...

CVE-2026-91204 Apache Roller: Stored javascript: URI in HTML comments

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...

CVE-2026-91206 Apache Roller: Reflected XSS in the optional LDAP comment authenticator

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping...

EUVD-2026-88125

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping...

CVE-2026-91206 Apache Roller: Reflected XSS in the optional LDAP comment authenticator

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping...

CVE-2026-91206 Apache Roller: Reflected XSS in the optional LDAP comment authenticator

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping...

CVE-2026-91206

Apache Roller version 6.1.5 is vulnerable to reflected cross-site scripting (XSS) due to improper neutralization of input during web page generation. The flaw exists specifically in the optional LdapCommentAuthenticator , which writes request parameter values into its HTML form without proper esc...

PT-2026-102409

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1 Description The software contains an unrestricted file upload issue within the FileController endpoints. These endpoints lack proper authorization checks and fail to validate uploaded file types. An authenticated...