PT-2026-104171

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTransportista” parameter is affected – endpoint “/es/carriers/update”...

CVE-2026-59669: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”...

PT-2026-104154

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-59665: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomMotivo” parameter is affected – endpoint “/es/lostmotives/store”...

CVE-2026-59670: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected – endpoint...

CVE-2026-59667: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”...

CVE-2026-93367: Improper Neutralization of Input During Web Page Generation

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the pagetitle parameter of the ahcprotrackvisitor AJAX action. The action is registered for logged-out callers...

PaperCut MF < 25.0.12 / 26.x < 26.0.2 RCE (CVE-2026-14780)

The version of PaperCut MF installed on the remote Windows host is prior to 25.0.12, or 26.x prior to 26.0.2. It is, therefore, affected by a vulnerability: - A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access...

PaperCut NG < 25.0.12 / 26.x < 26.0.2 RCE (CVE-2026-14780)

The version of PaperCut NG installed on the remote Windows host is prior to 25.0.12, or 26.x prior to 26.0.2. It is, therefore, affected by a vulnerability: - A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access...

CVE-2026-104414: Improper Neutralization of Input During Web Page Generation

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost...

RHEL 9 : Satellite 6.17.12 Async Update (Critical) (RHSA-2026:74505)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74505 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

RHCOS 4 : OpenShift Container Platform 4.18.56 (RHSA-2026:70614)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70614 advisory. - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 -...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.56 packages and security update

Red Hat OpenShift Container Platform release 4.18.56 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-71454

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting XSS. This issue affects CAPEC-63: before 3.0b63...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in ConversationsServiceImpl, whose saveTopic, savePost, and saveComment methods persist the submitted message field without passing it through FormattedText.processFormattedText, while the frontend renders those...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in ConversationsServiceImpl, whose saveTopic, savePost, and saveComment methods persist the submitted message field without passing it through FormattedText.processFormattedText, while the frontend renders those...