CVE-2026-10032: Improper Neutralization of Input During Web Page Generation

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

ALSA-2026:49922 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component CVE-2026-15718 firefox: thunderbird: Mitigation...

PT-2026-67648

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

jmespath.rb Memory Leak DoS

The vulnerability of the library for querying and filtering JSON data, jmespath.rb, is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker who operates remotely to cause service failures...

RHEL 9 : thunderbird (RHSA-2026:49921)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49921 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

PT-2026-67867

Name of the Vulnerable Software and Affected Versions O2OA version 10 Description A reflected cross-site scripting XSS issue exists in the Forum posting function. This allows attackers to execute arbitrary Javascript in the victim's browser by using a crafted URL. Recommendations At the moment,...

PT-2026-67652

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...

CVE-2026-52370

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

PT-2026-74498

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.2...

PT-2026-74497

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.2...

PT-2026-74224

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.1...

PT-2026-67730

Name of the Vulnerable Software and Affected Versions @a2ui/web core affected versions not specified Description The openUrl function fails to validate the URI scheme before passing a URL to window.open. A malicious agent can provide a javascript: URI via the url argument of a Button component's...

PT-2026-67817

Name of the Vulnerable Software and Affected Versions SNOMED International Snowstorm versions prior to 10.12.2 SNOMED International Snowstorm versions prior to 10.9.3 Description A reflected Cross-Site Scripting XSS issue exists within the "Web Route" redirection functionality. This allows an...

PT-2026-74451

TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 2.1.2-tuxcare.1...

PT-2026-73968

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 6.0.2-tuxcare.1...

PT-2026-74226

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 3.1.0-tuxcare.1...

PT-2026-74225

TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 4.0.0-tuxcare.1...

PT-2026-74111

TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 1.9.1-tuxcare.1...

📄 Flowise 3.1.2 Authenticated Remote Code Execution

A proof of concept exploit for an authenticated remote code execution vulnerability in Flowise version 3.1.2. The vulnerability allegedly exists because several record-manager and agent-memory components parse user-controlled additionalConfig JSON and pass its properties directly to a TypeORM...

CVE-2026-52370: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...