CVE-2026-103585 attacker-controlled javascript license URL via XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting XSS. This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43...

CVE-2026-103584 attacker-controlled javascript license URL via XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting XSS. This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43...

CVE-2026-103584 attacker-controlled javascript license URL via XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting XSS. This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43...

CVE-2026-103584

The MediaWiki CommonsMetadata extension (versions 1.46, 1.45, and 1.43 ) is vulnerable to a Cross-Site Scripting (XSS) flaw due to the improper neutralization of script-related HTML tags. This vulnerability allows an attacker to execute arbitrary script via an attacker-controlled javascript licen...

CVE-2026-102090

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of...

CLSA-2026-1790800048 containernetworking-plugins: Fix of 4 CVEs

rebuild with newer golang 1.22.9-1.el92.tuxcare.els26 to fix the following Go standard-library CVEs - CVE-2026-33818: encoding/asn1: enforce a maximum recursion depth in parseField and parseSequenceOf, so a deeply nested crafted DER payload can no longer exhaust the stack while unmarshalling -...

Important: Red Hat Security Advisory: python3.12-lxml security update

An update for python3.12-lxml is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

EUVD-2026-90277

An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...

CVE-2026-102138 Kiteworks Core Server-Side Request Forgery (SSRF)

An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...

CVE-2026-102138

The Kiteworks Core server is vulnerable to a Server-Side Request Forgery (SSRF) flaw. An authenticated administrator on a node with the optional, separately licensed gateway role enabled can provide a connector URL. Due to insufficient validation of the URL's scheme or destination, the server may...

CVE-2026-102138 Kiteworks Core Server-Side Request Forgery (SSRF)

An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

Important: Red Hat Security Advisory: python3.12-lxml security update

An update for python3.12-lxml is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

CVE-2026-102090 Kiteworks Core content injection

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of...

CVE-2026-102090

Kiteworks Core versions prior to 9.5.1 are vulnerable to a Content Injection flaw. The root cause is insufficient validation of a URL parameter within the PDF viewer , which allows an attacker to load and display a document under the trust of the legitimate application domain. This vulnerability ...

EUVD-2026-90371

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of...

CVE-2026-102090 Kiteworks Core content injection

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of...

Exploit for CVE-2026-76504

Cisco Catalyst SD-WAN Manager — CVE-2026-76504 Unauthenticate...

CLEANSTART-2026-PN80306 net/url package does not set a limit on the number of query parameters in a query

Security vulnerability affects the coredns package. The net/url package does not set a limit on the number of query parameters in a query...