PT-2026-89448

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

PT-2026-89437

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

PT-2026-89692

Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks such as href, src, action, xlink:href, and data to protect against Cross-Site Scripting XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings host: 'attr.href':...

CVE-2026-85645: Improper Neutralization of Input During Web Page Generation

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulkaction parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it...

RockyLinux 8 : osbuild-composer (RLSA-2026:66016)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:66016 advisory. golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect...

PT-2026-89449

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-81782: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

PT-2026-89561

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

RockyLinux 10 : osbuild-composer (RLSA-2026:65895)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65895 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 net/mail: golang: net/mai...

MiracleLinux 8 : grafana-9.2.10-33.el8_10 (AXSA:2026-1795:29)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1795:29 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service...

RHEL 10 : osbuild-composer (RHSA-2026:66327)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66327 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

ALSA-2026:66432 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

Gitlab -- vulnerabilities

Gitlab reports: Path Traversal issue in repository commits API impacts GitLab CE/EE Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE Buffer Overflow issue in Unicode conversion wrapper impacts GitLab EE Scheduled Pipeline Execution Policy test allows Developers ...

PT-2026-89440

Unauthenticated Cross Site Scripting XSS in Page Visits Counter Lite = 1.2.3 versions...

RockyLinux 9 : image-builder (RLSA-2026:65886)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65886 advisory. crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32281 crypto/x509: crypto/tls: golang: Go:...

AlmaLinux 8 : osbuild-composer (ALSA-2026:66016)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:66016 advisory. golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect...

PT-2026-89573

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes untrusted input inside template content nested in...

PT-2026-89429

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

CVE-2026-84816: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

CVE-2026-87926 Rizwan17 inventory-management-system Login Page index.php cross site scripting

A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknown processing of the file index.php of the component Login Page. Executing a manipulation of the argument msg can lead to cross site scripting. The attack can...