CVE-2026-95530: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...

CVE-2026-94500: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...

CVE-2026-94461: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...

CVE-2026-94168: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-94391: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Ultimate FAQ = 2.4.14 versions...

CVE-2026-94176: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.4.1 versions...

Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191

The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a...

RHEL 9 : containernetworking-plugins (RHSA-2026:70391)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:70391 advisory. The Container Network Interface CNI project consists of a specification and libraries for writing plug- ins for configuring network...

The vulnerability of the proxmox.inc.php script in the network monitoring system LibreNMS allows attackers to perform cross-site scripting attacks.

The vulnerability of the proxmox.inc.php script in the LibreNMS network monitoring system is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

RockyLinux 9 : containernetworking-plugins (RLSA-2026:70391)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70391 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial o...

AlmaLinux 10 : podman (ALSA-2026:70201)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70201 advisory. podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 podman: Go net/http: Unencrypted HTTP/2...

CVE-2026-94118: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Blocks – Gutenberg Blocks for WordPress = 2.3.17 versions...

PT-2026-97464

Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...

CVE-2026-94682: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...

Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ip...

CVE-2026-91999: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181

This module enables you to provide information and options about cookie usage. The module does not sufficiently filter input submitted through the Cookiecuttr administration form. This could allow specially crafted values to be stored and later rendered without adequate sanitization, resulting in...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Remote Post Handlers send webform data to other servers via APIs. The module does not sufficiently...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, th...