EulerOS Virtualization 2.11.1 : samba (EulerOS-SA-2026-3471)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Upstream Security Advisories: https://www.samba.org/samba/security/CVE-2007-2447.html...

EulerOS 2.0 SP10 : samba (EulerOS-SA-2026-3722)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the 'pri...

EulerOS Virtualization 2.12.0 : samba (EulerOS-SA-2026-3672)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...

EulerOS Virtualization 2.12.1 : samba (EulerOS-SA-2026-3618)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...

EulerOS Virtualization 2.11.0 : samba (EulerOS-SA-2026-3558)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Upstream Security Advisories: https://www.samba.org/samba/security/CVE-2007-2447.html...

Fedora 44 : sblim-cmpi-base (2026-7510dd645d)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7510dd645d advisory. Use mktemp for temporary files in provider registration script CVE-2026-73585 Tenable has extracted the preceding description block directly from th...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 < Security 2026 Update 3 Multiple XSS

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, or 11.5 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by multiple vulnerabilities: - A reflected cross site scripting vulnerability exists in Esri Portal for ArcGIS which may allow a...

Fedora 43 : sblim-cmpi-base (2026-fe1549bec3)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fe1549bec3 advisory. Use mktemp for temporary files in provider registration script CVE-2026-73585 Tenable has extracted the preceding description block directly from th...

Linux Distros Unpatched Vulnerability : CVE-2026-92973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets...

PT-2026-95428

Name of the Vulnerable Software and Affected Versions Concrete CMS Community Store versions prior to 2.7.8 Description The software fails to perform HTML escaping on customer-supplied order fields within checkout and admin views. This allows unauthenticated attackers to store malicious script...

CVE-2026-2585

The Brizy – Page Builder WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the rootAttributes parameter in versions up to and including 2.8.14 , caused by insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level or higher access c...

@platejs/core HTML deserialization can trigger browser behavior during parsing

Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes. Applications that deserialize HTML from untrusted or cross-user...

GHSA-QRFJ-MGW8-J9C6 @platejs/core HTML deserialization can trigger browser behavior during parsing

Summary HTML strings passed to Plate's core deserialization APIs were parsed in the active document. Certain HTML attributes could therefore trigger browser behavior during parsing, before the content was converted into editor nodes. Applications that deserialize HTML from untrusted or cross-user...

EUVD-2026-80782

@platejs/core HTML deserialization can trigger browser behavior during parsing...

GHSA-6QW9-4VV5-JR97 Grav: Stored XSS via Markdown audio/video media <source> URL

Target: github.com/getgrav/grav Affected resource: Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement — verified on 2.0.13 latest stable and develop HEAD 5a7070f Severity: Medium 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS...

Grav: Stored XSS via Markdown audio/video media <source> URL

Target: github.com/getgrav/grav Affected resource: Grav\Common\Media\Traits\AudioMediaTrait / VideoMediaTrait sourceParsedownElement — verified on 2.0.13 latest stable and develop HEAD 5a7070f Severity: Medium 6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS...

tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to...

CVE-2026-92973

A flaw was found in ansi2html. This cross-site scripting XSS vulnerability exists in the OSC 8 hyperlink handling, where the component fails to properly validate or escape URL targets. A remote attacker, by controlling ANSI text input, can inject malicious JavaScript schemes or manipulate href...

DEBIAN-CVE-2026-92973

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...

CVE-2026-92973

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes to execute arbitrary scripts in the...