EUVD-2026-72724

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor...

CVE-2026-77092

Commvault Content Extractor contained a deserialization of untrusted data flaw affecting privilege management , enabling privilege escalation . The NVD-assigned CVSS 3.1 score is 9.8 (CRITICAL) with a network vector and no required privileges, while the CNA-assigned CVSS 4.0 score is 7.3 (HIGH) w...

CVE-2026-77091

Commvault DataCube contained a path traversal flaw that could bypass security feature enforcement . The CVSS 4.0 score is 8.5 (HIGH) , with a local attack vector requiring low privileges and no user interaction, resulting in high impact to confidentiality, integrity, and availability of the vulne...

CVE-2026-77092 Content Extractor Privilege Escalation

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor...

CVE-2026-77091 DataCube Security Feature Bypass

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...

EUVD-2026-72723

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

Meta Failed to Catch Hundreds of AI Child Abuse Ads. Some Included Images of Real Kids

Images of real children—including a member of a European royal family—were used to create some of the 350 ads containing child sexual abuse. Lawmakers say they plan to investigate...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CLEANSTART-2026-BY91066 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the dynatrace-operator package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

CVE-2026-76968

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed...

CLEANSTART-2026-SH05010 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the opentelemetry-collector-contrib package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

CVE-2026-76968 Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed...

CVE-2026-76968 Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed...

CVE-2026-76968

SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server are affected by an information disclosure vulnerability (CVSS 6.5, MEDIUM). An authenticated low-privileged attacker can access certain administrative functionality or interfaces to obtain sensitive information about the s...

EUVD-2026-72585

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed...

CVE-2026-78834

A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page content and provide controlled imported content can trigger server-side execution by referencing crafted external or uploaded text content through the affected...

PT-2026-86960

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed...