Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

The Address Suggestion module provides address autocomplete functionality using configured address providers. The module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is...

PT-2026-81941

Name of the Vulnerable Software and Affected Versions Katello affected versions not specified Description An authorization flaw exists in the Content View History API. An authenticated user with permissions to view Content Views within one organization can access the lifecycle history of a Conten...

CVE-2026-77317: Incorrect Authorization

SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

PT-2026-82359

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.3 Description An authenticated user with the role:reader role on any project can list all project-scoped role assignments under any domain. This occurs when a domain ID is passed as scope.project.id wi...

Linux Distros Unpatched Vulnerability : CVE-2026-78962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially leak cross-origin...

Linux Distros Unpatched Vulnerability : CVE-2026-78960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a...

Linux Distros Unpatched Vulnerability : CVE-2026-78986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain...

Linux Distros Unpatched Vulnerability : CVE-2026-78896

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-79252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromiu...

PT-2026-82316

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

RHEL 9 : python-urllib3 (RHSA-2026:60371)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:60371 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031328)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031328 advisory. ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site...

Linux Distros Unpatched Vulnerability : CVE-2026-79285

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-79274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross- origin data via a crafted HTML page. Chromium securit...

CVE-2026-80197: Authorization Bypass Through User-Controlled Key

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

CVE-2025-56798

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

PT-2026-82324

Name of the Vulnerable Software and Affected Versions SeaweedFS versions 3.88 through 4.39 Description The SFTP server evaluates configured path permissions using a literal string-prefix comparison instead of requiring a path-component boundary. This allows an authenticated low-privilege user...