CVE-2026-94176: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.4.1 versions...

CVE-2026-94168: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-94118: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Blocks – Gutenberg Blocks for WordPress = 2.3.17 versions...

CVE-2026-95957: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote...

CVE-2026-91999: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91928: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91852: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-82369: Improper Neutralization of Special Elements used in an OS Command

Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell...

H5P Nodejs Library 10.0.4 Cross Site Scripting

Lumi Education h5p-nodejs-library versions through 10.0.4 contain a cross site scripting vulnerability due to insufficient validation of files contained in uploaded H5P content. An attacker can upload content containing malicious JavaScript that executes in another user's browser when the affecte...

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in...

PT-2026-97484

Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-166

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to raw webform source editing when the Webform UI module is not enabled. This could allow a user with webform creation ...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to the custom attributes YAML editor. Users with permission to create or edit webforms but without permission to edit...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a...

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

PT-2026-97189

Name of the Vulnerable Software and Affected Versions JSM Show Post Metadata WordPress plugin versions prior to 4.9.1 Description Insufficient escaping of a post meta key before it is output into an inline event-handler attribute within an admin-facing meta box allows users with contributor-level...

PT-2026-97588

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 3.0.1a Description Insufficient input sanitization of shell metacharacters in the CLI scripting component allows authenticated users to break out of restricted execution contexts on managed switches. An attacke...

Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ip...

Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...