Important: bouncycastle

Issue Overview: In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent cross-nonce AEAD forgery. This issue also affects Bouncy Castle for Java LTS before 2.73.12. CVE-2026-12803 In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets...

RHEL 9 : grafana-pcp (RHSA-2026:67160)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67160 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

CVE-2023-51769

Frappe before 14.49.0 is vulnerable to a Cross-Site Scripting (XSS) attack that affects blog pages and exception pages . The CVSS 3.1 score is 6.1 (MEDIUM) , with a network attack vector, low complexity, no privileges required, but user interaction required , and a changed scope leading to low im...

CVE-2024-23176

CVE-2024-23176 is a cross-site scripting (XSS) vulnerability in the MassMessage extension of MediaWiki versions before 1.40.2 . The root cause is that the i18n key massmessage-form-page-help fails to sanitize user-supplied input passed via the uselang parameter in a Special:MassMessage URL (e.g.,...

PT-2026-91179

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

PT-2026-91025

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed...

CVE-2025-68624

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server...

CVE-2023-51769

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages...

CVE-2024-23176

An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS...

CVE-2025-68624

N-able Mail Assure (formerly SolarWinds MSP Mail Assure), a cloud-based multi-tenant SMTP relay, contains a design-level authorization flaw (CWE-290) where an authenticated SMTP user can send outbound mail using MAIL FROM addresses of other tenants . After valid SMTP AUTH, the server accepts arbi...

About the security content of Safari 27

About the security content of Safari 27 This document describes the security content of Safari 27. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

EUVD-2023-60648

A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520...

PT-2026-91233

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

PT-2026-91840

Summary A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects shared between different organizations, potentially allowing users to ke...

PT-2026-91226

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

RHEL 9 : grafana-pcp (RHSA-2026:67132)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67132 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

RHEL 9 : grafana-pcp (RHSA-2026:67159)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67159 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

CVE-2024-33209

CVE-2024-33209 FlatPress 1.3. es vulnerable a Cross Site Scripting XSS. Un atacante puede inyectar código JavaScript malicioso en la sección "Agregar nueva entrada", lo que le permite ejecutar código arbitrario en el contexto del navegador web de la víctima. Tipo de vulnerabilidad: Cross Site...

CVE-2026-90602

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The...

CVE-2026-90604 Totolink A3002MU Anchor Tag cross site scripting

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...