CVE-2026-59662: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”...

PaperCut MF < 25.0.12 / 26.x < 26.0.2 RCE (CVE-2026-14780)

The version of PaperCut MF installed on the remote Windows host is prior to 25.0.12, or 26.x prior to 26.0.2. It is, therefore, affected by a vulnerability: - A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access...

RHCOS 4 : OpenShift Container Platform 4.18.56 (RHSA-2026:70614)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70614 advisory. - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 -...

CVE-2026-95662: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”...

CVE-2026-104414: Improper Neutralization of Input During Web Page Generation

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost...

PT-2026-104196

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”...

PT-2026-104189

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”...

CVE-2026-59666: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoint “/es/origins/store”...

PT-2026-104461

Name of the Vulnerable Software and Affected Versions Shopclass versions prior to 6.2.0 Description A stored cross-site scripting issue exists when the frontend TinyMCE is enabled. This allows self-registered non-admin users to inject malicious JavaScript into item listing descriptions. The...

PT-2026-104173

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomGrupoEmpresarial” parameter is affected – endpoint "/es/corporategroups/update/246”...

CVE-2026-59672: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomGrupoEmpresarial” parameter is affected – endpoint "/es/corporategroups/update/246”...

CVE-2026-93367: Improper Neutralization of Input During Web Page Generation

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the pagetitle parameter of the ahcprotrackvisitor AJAX action. The action is registered for logged-out callers...

CVE-2026-59670: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected – endpoint...

CVE-2026-104461: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

PT-2026-104224

Name of the Vulnerable Software and Affected Versions Ghost versions 5.94.0 through 6.63.0 Description A stored cross-site scripting issue exists that allows staff users, such as Contributors, to host arbitrary HTML. This is achieved by abusing the bookmark card image fetching mechanism, where...

PT-2026-104074

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the page title parameter of the ahcpro track visitor AJAX action. The action is registered for logged-out callers wp ajax...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.56 packages and security update

Red Hat OpenShift Container Platform release 4.18.56 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...