CVE-2026-47096

AJA HELO Plus firmware versions before 2.1.7 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is an unsanitized eParamID_SystemName value accepted through the /config?action=set web configuration API. Unauthenticated attackers with network access can inject malicious Jav...

EUVD-2026-89493

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-18105

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-18105: Uncontrolled Resource Consumption

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1769515411)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1769515411 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the...

CVE-2026-18105 Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-18105

A vulnerability in Fireware OS allows a low-privileged, authenticated user to cause a denial of service (DoS) of the system's diagnostic tools. The root cause is an uncontrolled resource consumption flaw within the diagnostic tasks feature. An attacker can trigger this by repeatedly starting and ...

CVE-2026-18105 Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

PT-2026-102947

Name of the Vulnerable Software and Affected Versions Fireware OS affected versions not specified Description An uncontrolled resource consumption issue exists in the diagnostic tasks feature. A low-privileged, authenticated user can trigger a denial of service of the system diagnostic tools by...

Amazon Linux 2 : ipa (ALAS-2026-3950)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3950 advisory. A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to...

SUSE CVE-2026-18147

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

WS-2026-0081

OpenBao before 2.6.3 / 2.7.0 contains an open redirect in the web UI OIDC provider route ui/app/routes/vault/cluster/oidc-provider.js: when an unauthenticated visitor requested the authorize route with prompt=none, the UI redirected to the supplied redirecturi without validating it. An attacker...

@ossph/temple-ui (0.1.7), @pinnacle0/web-ui (>=0.1.102, <=0.1.104) +5 more potentially affected by CVE-2026-59167 via suneditor (>=2.34.3, <=2.47.0)

suneditor NPM version =2.34.3, =0.1.102, =1.0.3-rc.1, =0.1.0, =0.1.0, =0.1.8, =0.1.1, =0.1.12 Source cves: CVE-2026-59167 Source advisory: GHSA-6RF4-V2FH-M6P4...

CVE-2026-1037

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2026-1029

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

CVE-2026-1031

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2026-1025

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials...

CVE-2025-36147

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi...

CVE-2026-1037 Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...