PT-2026-88337

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into HTML with no escaping. Two of the library's own messages, no...

Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 mime: golang:...

Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

ALSA-2026:65117 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 mime: golang:...

CVE-2026-78738

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...

EUVD-2026-74259

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...

EUVD-2026-74261

Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting XSS via the Document management file upload feature...

ALSA-2026:65116 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 mime: golang:...

RHEL 9 : ignition (RHSA-2026:65336)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65336 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing fil...

Linux Distros Unpatched Vulnerability : CVE-2026-85630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the processattrs method. Any application with field...

WordPress Graphina – Charts and Graphs For Elementor plugin <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin Graphina versions = 3.1.11...

PT-2026-86992

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...

PT-2026-86993

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

CVE-2026-78742

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...

CVE-2026-78741

Silverpeas Core versions up to 6.4.6 are affected by a Cross-Site Scripting (XSS) vulnerability in the wysiwyg-CKEditor image upload feature. The flaw allows an unauthenticated remote attacker, with user interaction, to inject malicious scripts via the image upload mechanism, resulting in a chang...

Microsoft Exchange Server (September 2026)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. CVE-2026-55007 - External control of file name...

CVE-2026-78742

Silverpeas Core versions up to and including 6.4.6 are vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction field. The flaw allows an attacker to inject malicious scripts that execute in another user's browser, with changed scope and low impact on both conf...

CVE-2026-78738

Silverpeas Core 6.4.6 is vulnerable to Cross-Site Scripting (XSS) via the Document management file upload feature . An attacker can craft a malicious document file that, when uploaded and processed by the application, injects script executed in the context of other users' browsers. The CVSS 3.1 b...

CVE-2026-86484

JetBrains YouTrack before version 2026.2.18634 is vulnerable to a stored cross-site scripting (XSS) flaw caused by AngularJS template injection in assignee names. An authenticated user (low privileges) can craft a malicious assignee name that, when viewed by another user, executes arbitrary scrip...

CVE-2026-86431

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...