CVE-2026-84188

LibreNMS versions ≤ 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr. configuration settings. The value is echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php, allowing an authenticated administrator to store a malicious HTML payload that execu...

EUVD-2026-69025

LibreNMS versions configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in...

CVE-2026-84188 librenms before 26.7.0 Stored XSS via graph_descr settings

LibreNMS versions configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in...

CVE-2026-84188 librenms before 26.7.0 Stored XSS via graph_descr settings

LibreNMS versions configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in...

MGASA-2026-0360 Updated perl-HTML-FormHandler packages fix a security vulnerability

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template...

Updated perl-HTML-FormHandler packages fix a security vulnerability

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2026-89830

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because apply actions and add error use error message text built from request data as a Locale::Maketext bracket notation template...

CVE-2026-84137: Origin Validation Error

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

CVE-2026-84125: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

PT-2026-84132

The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

PT-2026-84547

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description An uninitialized resource in the V8 engine allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to open a specially crafted HTML page...

PT-2026-84565

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in Navigation allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. The web origin polic...

PT-2026-84553

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in SiteSettings allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-84566

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description A UI misrepresentation issue in FullScreen mode allows a remote attacker to spoof the address bar by using a specially crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-84558

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description An information leak exists in the MediaCapture component. A remote attacker can potentially leak sensitive information by inducing a user to visit a crafted HTML page. Recommendations...

PT-2026-84551

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.75 Description A UI misrepresentation issue in FullScreen mode allows a remote attacker to spoof the address bar by using a crafted HTML page. Recommendations Update Google Chrome on Androi...

ALSA-2026:62144 Moderate: wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Memory corruption via crafted Metalink URL CVE-2026-58469 wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471...

CVE-2026-84124: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...