CLEANSTART-2026-MX72137 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the temporal-server package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-NX24657 Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name

Security vulnerability affects the rundeck package. Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name...

PT-2026-106412

Contributor Remote Code Execution RCE in Content Visibility for Divi Builder = 5.03 versions...

PT-2026-107279

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.17.8 Description The @backstage/backend-defaults package contains improper input validation within cloud storage URL readers. An attacker possessing write access to a cloud storage bucket utilized by the framework...

PT-2026-106721

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

PT-2026-106327

Contributor Broken Access Control in WDS MCP Content Manager = 3.10.4 versions...

PT-2026-106733

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parse header parameters was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An...

Linux Distros Unpatched Vulnerability : CVE-2026-84429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. django.utils.http.parseheaderparameters was subject to a potential...

Rocky Linux 8 [CIQ] Security Update: idm-jss / idm-jss-debuginfo / idm-jss-javadoc / idm-ldapjdk / etc (crlsa-2026_75573)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675573 advisory. pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 Tenable has extracted the...

SUSE SLES16: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:23981-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23981-1 advisory. Update to Firefox Extended Support Release 153.4.0 ESR MFSA 2026-100, bsc1282929: - CVE-2026-96869: Information disclosure in the...

cve-2023-41564-research

Resumen de la vulnerabilidad CVE-2023-41564 CVE-2023-415641 es una vulnerabilidad de XSS almacenado presente en el CMS Cockpit = v2.6.3. Al cargar un archivo HTML con extensión .shtml durante la subida de archivos, el JavaScript se ejecuta en el momento en que se abre el archivo subido. 1:...

CVE-2023-41436-CSZ-CMS-Stored-XSS---Pages-Content

CSZ CMS Stored XSS v1.3.0 Autor: Sergio CVE: 2023-41436 Descripción: La vulnerabilidad de Cross Site Scripting en CSZCMS v.1.3.0 permite a un atacante local ejecutar código arbitrario a través de un script manipulado en el parámetro Additional Meta Tag del componente Pages Content Menu. Vectores ...

GHSA-6688-9RHM-GJV2 DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

Environment - dompurify 3.4.15 current npm release; reproduced independently on jsdom 30.0.1 and 29.1.1 Node.js 20.x / 26.x - Config: DOMPurify.sanitizenode, INPLACE: true on a Node input; SAFEFORXML at its default true Summary The 3.4.9 fix for the INPLACE detached-root class added two protectio...

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

Environment - dompurify 3.4.15 current npm release; reproduced independently on jsdom 30.0.1 and 29.1.1 Node.js 20.x / 26.x - Config: DOMPurify.sanitizenode, INPLACE: true on a Node input; SAFEFORXML at its default true Summary The 3.4.9 fix for the INPLACE detached-root class added two protectio...

CVE-2019-19945_Test

CVE-2019-19945Prueba Este es el código para la primera CVE propuesta. 1. Instalar Docker 2. Construir y ejecutar servidor cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve 3. Obtener la IP del contenedor del servidor Linux sudo docker container inspect server ...

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

GHSA-GXM5-99CW-XJW9 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Impact @fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is...

CVE-2026-100770

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Content Processes component...

CVE-2026-100762

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Content Processes component...

CVE-2026-105766

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...