CVE-2026-92001

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91928

The Apache Sling XSS component is vulnerable to a cross-site scripting (XSS) issue caused by the improper neutralization of input during web page generation. This vulnerability affects versions prior to 2.4.12 . The CVSS 3.1 score is 6.1 (MEDIUM) , indicating that while exploitation requires user...

EUVD-2026-85176

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91999

The Apache Sling XSS component (versions before 2.4.12 ) is vulnerable to a cross-site scripting (XSS) flaw due to improper neutralization of input during web page generation. This vulnerability could allow an attacker to execute scripts in a user's browser session. To remediate this issue, users...

CVE-2026-91999 Apache Sling XSS: Improper escaping in the XSS Webconsole plugin

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-92001 Apache Sling XSS: Missing parser resource limits

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91928: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-74849

Zohocorp ManageEngine ADSelfService Plus versions prior to build 7001 contain a remote code execution vulnerability in the GINA client . The CNA-assigned CVSS v3.1 score is 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploitable flaw requiring no authentic...

EUVD-2026-84337

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8...

EUVD-2026-84256

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...

Linux Distros Unpatched Vulnerability : CVE-2026-94054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. CVE-2026-94054 Note that Nessus relies on the...

CVE-2026-10747

IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication...

CVE-2026-84448 libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

CVE-2026-93658

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with...

CVE-2026-37236 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10

CVE-2026-37236 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10. A patched version of the package is available...

CVE-2026-81634 affecting package unbound for versions less than 1.26.1-1

CVE-2026-81634 affecting package unbound for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-78227 affecting package unbound for versions less than 1.26.1-1

CVE-2026-78227 affecting package unbound for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-78254 affecting package ant for versions less than 1.10.18-1

CVE-2026-78254 affecting package ant for versions less than 1.10.18-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-93657

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup and Resolver::lookupip APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged D...

CVE-2026-90428 iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs

In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs tegra241cmdqvprobe requests the error IRQ before it has allocated the cmdqv-vintfs array and set cmdqv-numvintfs. A CMDQV left enabled with a latched error...