CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

HackerOne: HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks

A password reset token was transmitted to a real user monitoring service before the reset form was submitted. The token was passed as a query string parameter in the URL and recorded by the monitoring SDK without any redaction. The same monitoring session also captured the account identifier afte...

Malicious Package

Overview cleanup-string is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in cleanup-string (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the...

MAL-2026-17325 Malicious code in cleanup-string (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the...

EUVD-2026-89475

The application uses unsafe functions that allow execution of inline scripts and string evaluation functions...

AlmaLinux 9.2 [TuxCare] Security Update: nano (ALMALINUX9.2:CLSA-2026:1780920842)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780920842 advisory. - A flaw was found in nano. A local user could exploit a format string vulnerability in the statusline function. By creating a directory with...

CVE-2026-47494: Use of Externally-Controlled Format String

NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.5:CLSA-2026:1767609927)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1767609927 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query strin...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.2:CLSA-2025:1767004508)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1767004508 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query strin...

PT-2026-105476

Summary HTTPServerRequest. init in tornado/httputil.py parses the URL query string via parse qs bytes with no field-count limit — while the sibling POST-body parsing path parse body arguments received a max num fields=1000 cap added earlier in this exact same release v6.5.8, commit 8d6363ed,...

PT-2026-103336

Name of the Vulnerable Software and Affected Versions NVIDIA GPU Display Driver for Linux affected versions not specified Description A format string issue exists in the driver, which occurs when an application provides an improperly formatted string to a function that processes it. This could...

PT-2026-103126

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.6:CLSA-2025:1767027096)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767027096 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query strin...

CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc (CENTOS-STREAM8:CLSA-2026:1772120065)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1772120065 advisory. - The zendstringextend function in Zend/zendstring.h in PHP through 7.1.5 does not prevent changes to string objects that result in a...

CentOS Linux 7 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1779466432)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1779466432 advisory. - Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an...

CentOS Linux 8.5 [TuxCare] Security Update: ImageMagick / ImageMagick-c++ / ImageMagick-c++-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1776257772)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1776257772 advisory. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to ImageMagick versions...

AlmaLinux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl (ALMALINUX9.6:CLSA-2026:1786493710)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786493710 advisory. - Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit...

USB-HID Protocol Analyzer DoS

The vulnerability of the USB-HID protocol analyzer, a traffic analyzer for computer networks developed by Wireshark, is related to insufficient processing of the format string. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Rocky Linux 9.6 [TuxCare] Security Update: butane / butane-redistributable (ALMALINUX9.6:CLSA-2026:1772573053)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772573053 advisory. - Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out...