Linux Distros Unpatched Vulnerability : CVE-2026-109266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived da...

SUSE CVE-2026-109266

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary mark...

DEBIAN-CVE-2026-109266

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary mark...

UBUNTU-CVE-2026-109266

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary mark...

CVE-2026-109266 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary mark...

CVE-2026-109266

The ImageMagick image processing library versions prior to 6.9.13-57 and 7.x before 7.1.2-32 are vulnerable to XML injection within the CIP encoder . The root cause is the failure to properly escape input-derived data when generating Cisco IP Phone XML output . An attacker can provide a specially...

CVE-2026-109266 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary mark...

PT-2026-110683

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description An XML injection issue exists in the CIP encoder. The software fails to properly escape input-derived data when generating Cisco IP Phone XML output. Th...

EUVD-2026-94193

The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site...

PT-2026-102305

Name of the Vulnerable Software and Affected Versions Vehicle Manager Free versions prior to 6.5.8 Description Reflected Cross-Site Scripting occurs on the public vehicle-detail page when the task=view endpoint is used. The application echoes the title request parameter directly into a...

CVE-2026-68921

In DiceBear versions prior to 9.4.3, @dicebear/core interpolates the rotate option without XML escaping in addRotate (svg.ts), and @dicebear/initials emits fontSize/fontWeight unescaped (index.ts). Runtime callers can pass strings despite numeric types, break out of attributes, and inject arbitra...

PT-2026-66515

Name of the Vulnerable Software and Affected Versions Apache JSPWiki versions prior to 2.12.4 Description Lack of authentication allows the rendering of arbitrary Wiki Markup, which enables an attacker to retrieve sensitive data stored in JSPWiki variables. Recommendations Upgrade to version 2.12...

EUVD-2026-43288

The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments...

CVE-2026-12273

The Tutor LMS WordPress plugin, in versions prior to 3.9.13 , is vulnerable to an authorization and post-target validation flaw. A lack of proper checks in one of its handlers allows authenticated users with subscriber-level access and above to create comments across any content on the site. Beca...

CVE-2026-25681

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

CVE-2026-42506

A flaw was found in golang.org/x/net/html. When parsing arbitrary HTML that is subsequently rendered, an unexpected HTML tree can be generated. A remote attacker could leverage this vulnerability to execute Cross-Site Scripting XSS attacks in applications that attempt to sanitize input HTML befor...

CVE-2026-42502

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting XSS attacks, where...

SUSE CVE-2026-25681

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

UBUNTU-CVE-2026-25681

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

EUVD-2026-31451

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...