golang security update

An update is available for golang. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The golang packages provide the Go programming language compiler. Security...

RLSA-2026:22121 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum validation flaw via malicious module proxy...

golang security update

An update is available for golang. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The golang packages provide the Go programming language compiler. Security...

go-toolset:rhel8 security update

An update is available for golang, module.golang, module.delve, delve. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset provides the Go programming...

RLSA-2026:22112 Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum...

Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting XSS vulnerability. Note: This vulnerability was fixed in 8.x-2.1 but that w...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

RHEL 8 : go-toolset:rhel8 (RHSA-2026:60305)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60305 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: encoding/asn1:...

RHEL 10 : golang (RHSA-2026:60306)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60306 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servi...

PT-2026-82364

Name of the Vulnerable Software and Affected Versions Drupal Slick Carousel versions 0.0.0 through 2.1.0 Description Improper neutralization of input during web page generation in the Slick UI sub-module allows for Stored Cross-site Scripting XSS. The issue occurs because the module does not...

CVE-2026-2388: Improper Neutralization of Input During Web Page Generation

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wpdisplay shortcode handler, used by multiple shortcodes, allowing attacker-controlled htmltags values to define raw HTML tags a...

CVE-2026-39275: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-54606: Improper Neutralization of Input During Web Page Generation

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

ALSA-2026:60305 Important: go-toolset:rhel8 security, bug fix, and enhancement update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadrati...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093171 advisory. GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

EUVD-2026-66750

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

PT-2026-82293

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions prior to 2.13.6 Description A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code. This occurs through the 'item.php' endpoint and the field-select.js and tags.js components. Recommendations...

CVE-2026-39275

Cockpit CMS versions 2.13.5 and before are vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) leading to Account Takeover . The root cause is the lack of output encoding when passing render() outputs to the Vue.js v-html directive within the item.php , field-select.js , and ...