RHEL 9 : buildah (RHSA-2026:70640)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70640 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

VulnCheck KEV: CVE-2022-28368

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

CVE-2026-91121: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was th...

CVE-2026-91120: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-84151: Improper Neutralization of Input During Web Page Generation

The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leadin...

PT-2026-97711

Name of the Vulnerable Software and Affected Versions The Post Grid versions prior to 7.9.5 Description The plugin fails to limit the expansion of the WordPress allowed-HTML list to its own markup, applying the change site-wide. This allows users with the Contributor role and above to store ifram...

PT-2026-98203

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description Provider-controlled video titles in lazy video embeds can be reparsed as HTML durin...

PT-2026-98241

Name of the Vulnerable Software and Affected Versions EmbedVideo Extension versions prior to 4.1.0 Description When the $wgEmbedVideoRequireConsent variable is disabled, video URLs are passed into an iframe src attribute without proper sanitization. This allows an attacker to use a malformed URL ...

PT-2026-98204

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description Attacker-controlled upload filenames used in chat message excerpts are rendered as...

PT-2026-98207

Name of the Vulnerable Software and Affected Versions volotat Anagnorisis versions prior to 0.4.12 Description Cross site scripting occurs in the Media Filename Handler component due to improper handling of the file path argument within the html function of the PlaylistManager.js file. This allow...

RHEL 9 : skopeo (RHSA-2026:70641)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70641 advisory. Command line utility to inspect images and repositories directly on Docker registries without the need to pull them. Security Fixes: skopeo...

Fedora 43 : perl-HTML-FormHandler (2026-167a356523)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-167a356523 advisory. HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method CVE-2026-85630...

Fedora 44 : perl-HTML-FormHandler (2026-21850d7df0)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-21850d7df0 advisory. HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method CVE-2026-85630...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

DRUPAL-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

SUSE CVE-2026-95288

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95309

UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-95321

UI misrepresentation in Payments in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...