CVE-2026-86738: Improper Neutralization of Input During Web Page Generation

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

PT-2026-87928

Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network...

RHEL 10 : git-lfs (RHSA-2026:64788)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:64788 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...

AlmaLinux 10 : git-lfs (ALSA-2026:64788)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:64788 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial o...

CVE-2026-69434: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows URL Moniker allows an unauthorized attacker to execute code over a network...

NewStart CGSL MAIN 7.02 : python-webob Vulnerability (NS-SA-2026-0107)

The remote NewStart CGSL host, running version MAIN 7.02, has python-webob packages installed that are affected by a vulnerability: - WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the U...

PT-2026-87136

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

PT-2026-88335

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

PT-2026-87016

NuBrowser lacks protocol whitelist validation for the S.browser fallback url field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websit...

CVE-2026-78635: Improper Neutralization of Argument Delimiters in a Command

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag,...

CVE-2026-86853: User Interface (UI) Misrepresentation of Critical Information

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1...

CVE-2026-86550: Improper Neutralization of Input During Web Page Generation

NuBrowser lacks protocol whitelist validation for the S.browserfallbackurl field of intent://, allowing attackers to inject javascript: URLs via 302 redirects. This results in a universal cross‑site scripting UXSS vulnerability that enables script execution within the origin of arbitrary websites...

ALSA-2026:64788 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

CVE-2026-28631: URL Redirection to Untrusted Site

In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-87465

Heap-based buffer overflow in Windows URL Moniker allows an unauthorized attacker to execute code over a network...

PT-2026-87060

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...

PT-2026-88442

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag,...

PT-2026-88152

Impact Instance AI credential setup accepted a credential test/verification URL without checking it matched the workflow node's origin. Exfiltration required the user to actively inject an attacker-controlled URL into the setup flow. The patch derives the credential destination from the node's ow...

CVE-2026-19651: Authorization Bypass Through User-Controlled Key

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input...

ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...