CentOS Linux 6 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ssl Multiple Vulnerabilities (CENTOS6:CLSA-2026:1781623309)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1781623309 advisory. - A cross-site scripting vulnerability exists in modproxyftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1752126532)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1752126532 advisory. - modlua.c in the modlua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in whic...

Linux Distros Unpatched Vulnerability : CVE-2026-55214

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website field...

PT-2026-103265

Contributor Cross Site Scripting XSS in King Addons for Elementor = 51.1.86 versions...

PT-2026-103198

Contributor Cross Site Scripting XSS in pixfort Core 4.3.3 versions...

PT-2026-103213

Contributor Cross Site Scripting XSS in The Plus Addons for Elementor Page Builder Lite = 6.5.1 versions...

PT-2026-103149

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

PT-2026-103263

Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...

CVE-2026-96819: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in oik = 4.15.4 versions...

CVE-2026-103389: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...

PT-2026-103288

MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...

PT-2026-103041

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

PT-2026-102995

A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1781209763)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1781209763 advisory. - Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration This issue affects Apache HTTP...

PT-2026-103259

Name of the Vulnerable Software and Affected Versions WP Chill Strong Testimonials versions prior to 3.3.12 Description Stored Cross-site Scripting XSS occurs due to improper neutralization of input during web page generation. This allows a contributor to inject malicious scripts into the...

PT-2026-103117

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

PT-2026-103234

Subscriber Cross Site Scripting XSS in JetEngine = 3.8.14.3 versions...

CVE-2026-102586: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc (ALMALINUX9.2:CLSA-2025:1753121138)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753121138 advisory. - A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2,...

Linux Distros Unpatched Vulnerability : CVE-2026-100821

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird...