Oracle Linux 9 : osbuild-composer (ELSA-2026-1381)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-1381 advisory. 149-3.0.1 - Add missing dependency over dracut-config-rescue for image-installer ORABUG: 38587453 - Switch to UEKR8 repositories for OL9.6 Orabug: 37962207 - Ad...

PT-2026-5242

Name of the Vulnerable Software and Affected Versions Drupal Canvas versions prior to 1.0.4 Description The Drupal Canvas module has an authorization issue that allows forceful browsing of Canvas Pages when they are unpublished. The module does not adequately validate access to Canvas Pages,...

CVE-2026-0749: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Form Builder allows Cross-Site Scripting XSS.This issue affects Drupal: from 7.X-1.0 through 7.X-1.22...

PT-2026-5189

Name of the Vulnerable Software and Affected Versions Drupal Form Builder versions 7.X-1.0 through 7.X-1.22 Description A flaw exists in Drupal Form Builder that allows for Cross-Site Scripting XSS. This issue is due to improper neutralization of input during web page generation. Successful...

Drupal Form Builder security vulnerabilities

Drupal Form Builder is a form generation plugin for the Drupal community. Versions 7.X-1.0 to 7.X-1.22 of Drupal Form Builder have security vulnerabilities. These vulnerabilities stem from improper input handling during form generation, which may lead to cross-site scripting attacks...

CVE-2025-14283: Improper Neutralization of Input During Web Page Generation

The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BlockArt Counter in all versions up to, and including, 2.2.14 due to insufficient input sanitization and outpu...

Moderate: Red Hat Security Advisory: image-builder security update

An update for image-builder is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

OSV-2026-153 Security exception in org.apache.lucene.analysis.miscellaneous.ConcatenateGraphFilter$BytesRefBuilderT

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=478558485 Crash type: Security exception Crash state: org.apache.lucene.analysis.miscellaneous.ConcatenateGraphFilter$BytesRefBuilderT org.apache.lucene.analysis.miscellaneous.ConcatenateGraphFilter$BytesRefBuilderT...

ALSA-2026:1377 Moderate: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 For more details about the security issues, including the impact, a CVSS scor...

RHEL 10 : osbuild-composer (RHSA-2026:1378)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:1378 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for...

Moderate: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 For more details about the security issues, including the impact, a CVSS scor...

RHEL 9 : image-builder (RHSA-2026:1377)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:1377 advisory. A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: golang:...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0-beta.18), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.0-beta.18) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0-beta.0, <=1.5.0-beta.18)

@saltcorn/data NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-15126137...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.0-beta.18) +1 more potentially affected by unknown CVE via @saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0-beta.18)

@saltcorn/admin-models NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNADMINMODELS-15126138...

@saltcorn/cli (>=1.1.1, <=1.4.1), @saltcorn/mobile-builder (>=1.1.1, <=1.4.1) potentially affected by unknown CVE via @saltcorn/server (>=1.1.1, <=1.4.1)

@saltcorn/server NPM version =1.1.1, =1.1.1, =1.1.1, =1.4.1 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15126139...

@saltcorn/cli (>=1.1.1, <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.1.1, <=1.5.0-beta.18) potentially affected by unknown CVE via @saltcorn/server (>=1.1.1, <=1.5.0-beta.18)

@saltcorn/server NPM version =1.1.1, =1.1.1, =1.1.1, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: OSV:GHSA-CR3W-CW5W-H3FJ...

@saltcorn/cli (>=1.1.1, <=1.4.1), @saltcorn/mobile-builder (>=1.1.1, <=1.4.1) +1 more potentially affected by unknown CVE via @saltcorn/admin-models (>=1.1.1, <=1.4.1)

@saltcorn/admin-models NPM version =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.4.1 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNADMINMODELS-15126138...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.0-beta.18) potentially affected by unknown CVE via @saltcorn/server (>=1.5.0-beta.0, <=1.5.0-beta.18)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15126139...

@saltcorn/cli (>=1.1.1, <=1.5.0-beta.18), @saltcorn/mobile-builder (>=1.1.1, <=1.5.0-beta.18) potentially affected by unknown CVE via @saltcorn/server (>=1.1.1, <=1.5.0-beta.18)

@saltcorn/server NPM version =1.1.1, =1.1.1, =1.1.1, =1.5.0-beta.18 Source cves: unknown CVE Source advisory: GHSA-CR3W-CW5W-H3FJ...

@saltcorn/admin-models (>=1.1.1, <=1.4.1), @saltcorn/base-plugin (>=1.1.1, <=1.4.1) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.1.1, <=1.4.1)

@saltcorn/data NPM version =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.1.1, =1.4.1 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-15126137...