CVE-2026-55562

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-55562

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-55562 Cronicle: Stored XSS in admin Activity Log via account full_name field

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-55562

Cronicle, a multi-server task scheduler and runner, contains a Stored XSS vulnerability in the administrator Activity Log prior to version 0.9.119 . The flaw exists in htdocs/js/pages/admin/Activity.js, where the item.user.full_name value is concatenated into HTML without proper encoding. Attacke...

CVE-2026-55562 Cronicle: Stored XSS in admin Activity Log via account full_name field

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-55562: Improper Neutralization of Input During Web Page Generation

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-109565

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

CVE-2026-109565 Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

EUVD-2026-97888

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

CVE-2026-109565

Rapyd Admin versions 9.4.0 through 9.19.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the unescaped rendering of self-registered display names within the Activity log Author filter . Unauthenticated attackers can register with a malicious HTML or JavaScr...

CVE-2026-109565 Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

CVE-2026-109565: Improper Neutralization of Input During Web Page Generation

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

PT-2026-110941

🚨 CVE-2026-109565 Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log...

CVE-2026-107393

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...

CVE-2026-107393

Prior to version 1.8.235 , FreeScout (a self-hosted help desk) is vulnerable to Stored HTML Injection when the APP_CLOUDFLARE_IS_USED setting is enabled. The application trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. Th...

CVE-2026-107393 FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...

CVE-2026-107393 FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...

PT-2026-108190

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.235 Description When the APP CLOUDFLARE IS USED setting is enabled, the software trusts an unvalidated CF-Connecting-IP header during failed login attempts and records the spoofed value in the activity log. The...

CVE-2026-107393: Improper Neutralization of Input During Web Page Generation

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APPCLOUDFLAREISUSED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrato...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drbd: fixed the “LOGIC BUG” in drbdalbeginiononblock Although we ensure that we can perform lcgetcumulative while holding the device-allock spinlock, it may still fail if some other code path decides to use lctrylock at the wrong...