CVE-2026-7173: Improper Neutralization of Input During Web Page Generation

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events/ /editgeneral during...

PT-2026-105184

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

Rocky Linux 8 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc (crlsa-2020_4453)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20204453 advisory. vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode CVE-2019-20807 Tenable has extracted the preceding description blo...

AlmaLinux 9.6 [TuxCare] Security Update: redis / redis-devel / redis-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778616298)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778616298 advisory. - Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can...

CVE-2026-71454: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting XSS. This issue affects CAPEC-63: before 3.0b63...

CVE-2026-103266: Incorrect Authorization

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the...

PT-2026-105816

Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...

Linux Distros Unpatched Vulnerability : CVE-2026-86898

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a...

PT-2026-104027

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting XSS. This issue affects CAPEC-63: before 3.0b63...

Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2026_70640)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202670640 advisory. buildah: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56853 buildah: Go html/template: Cross-Site Scripting via...

Rocky Linux 10.2 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_65116)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202665116 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service vi...

Rocky Linux 10.2 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2026_63022)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202663022 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service vi...

Rocky Linux 9 [CIQ] Security Update: osbuild-composer / osbuild-composer-core / etc Multiple Vulnerabilities (crlsa-2026_69293)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669293 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_22121)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202622121 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass du...

Rocky Linux 10.2 [CIQ] Security Update: grafana-pcp / grafana-pcp-debuginfo / grafana-pcp-debugsource Multiple Vulnerabilities (crlsa-2026_63119)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202663119 advisory. mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-42504 encoding/asn1: golang: Go encoding/asn1: Denial of...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_37123)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202637123 advisory. golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-39835 golang.org/x/crypto/ssh:...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_60304)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202660304 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

Rocky Linux 9 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests Multiple Vulnerabilities (crlsa-2026_70641)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202670641 advisory. skopeo: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56858 skopeo: Go encoding/asn1: Denial of Service via excessive recursion i...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc Multiple Vulnerabilities (crlsa-2026_69961)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669961 advisory. podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 podman: golang net/url: Denial of Service from quadratic...

Linux Distros Unpatched Vulnerability : CVE-2026-102329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted...