CVE-2026-85484

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element...

EUVD-2026-74167

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element...

CVE-2026-78545

Okta Access Gateway is vulnerable to improper input sanitization in the application label field. The unsanitized value is interpolated directly into an nginx server block directive within the generated configuration file, allowing an attacker to inject arbitrary directives. This requires high pri...

EUVD-2026-74163

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives...

CVE-2026-78545 Improper Input Sanitization in Okta Access Gateway Application Label Configuration

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives...

CVE-2026-78545 Improper Input Sanitization in Okta Access Gateway Application Label Configuration

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

CLEANSTART-2026-NZ56993 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the aws-network-policy-agent package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-PE88816 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the helm-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

CLEANSTART-2026-RE39938 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

Multiple security vulnerabilities affect the istio package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. See references for individual vulnerability details...

PT-2026-88426

The Okta Access Gateway does not sanitize the application label field before including it in the generated nginx configuration file. The unsanitized value is interpolated into an nginx server block directive, resulting in execution of injected directives...

NewStart CGSL MAIN 7.02 : containerd Multiple Vulnerabilities (NS-SA-2026-0097)

The remote NewStart CGSL host, running version MAIN 7.02, has containerd packages installed that are affected by multiple vulnerabilities: - containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image...

Security update for perl-URI

This update for perl-URI fixes the following issue: CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing normalization in nameprep bsc1277886. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate ...

CVE-2026-86430

league/commonmark (a PHP Markdown parsing library) versions before 2.9.1 are affected by multiple denial-of-service vulnerabilities in three components: fenced code block detection , reference link label lookup , and emphasis delimiter processing . The root cause is super-linear work performed on...

CVE-2026-77830

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16649

Gravity Forms for WordPress (all versions up to and including 2.10.5 ) is vulnerable to unauthenticated Stored Cross-Site Scripting via the Post Body Field Value. The root cause is insufficient input sanitization and output escaping: wp_kses_post permits the required HTML tags and attributes, whi...

EUVD-2026-71878

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-77830 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-77830

The Spam protection, Honeypot, Anti-Spam by CleanTalk WordPress plugin (versions ≤ 6.86 ) contains a Stored Cross-Site Scripting vulnerability in the Comment Content aria-label Placeholder , caused by insufficient input sanitization and output escaping. Authenticated attackers with custom-level a...

CVE-2026-77830 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...