EUVD-2026-74259

Silverpeas Core =6.4.6 is vulnerable to Cross Site Scripting XSS via the Multimedia library application introduction...

PT-2026-88397

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-88339

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-88344

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-88350

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-86668: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The...

PT-2026-87396

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description Improper neutralization of input during web page generation leads to a cross-site scripting issue, which allows an unauthorized attacker to perform spoofing over a network...

PT-2026-88732

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Cross-site scripting in the SanitizerAPI allows a remote attacker to bypass the web origin policy through the use of a crafted HTML page. Cross-site scripting is a technique where...

ALSA-2026:64818 Important: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 encoding/asn1: golang: Go...

ALSA-2026:65116 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 mime: golang:...

ALSA-2026:64772 Important: xmlrpc-c security update

XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC remote procedure call over the Internet. It converts an RPC into an XML document,...

ALSA-2026:65117 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39820 mime: golang:...

ALSA-2026:65153 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: net/mail:...

RHEL 10 : buildah (RHSA-2026:64777)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64777 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

RHEL 9 : ignition (RHSA-2026:65359)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65359 advisory. Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing fil...

CVE-2026-86484

JetBrains YouTrack before version 2026.2.18634 is vulnerable to a stored cross-site scripting (XSS) flaw caused by AngularJS template injection in assignee names. An authenticated user (low privileges) can craft a malicious assignee name that, when viewed by another user, executes arbitrary scrip...

Cross-site Scripting (XSS)

Overview league/commonmark is a PHP-based Markdown parser which supports the full CommonMark spec. It is based on the CommonMark JS reference implementation. Affected versions of this package are vulnerable to Cross-site Scripting XSS through AttributesHelper::filterAttributes in...

WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by care in WordPress Plugin Open User Map versions = 1.4.50...

CVE-2026-86431

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...

WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Anthony Green of Greenhat Security in WordPress Plugin JetFormBuilder versions = 3.6.5.1...