Linux Distros Unpatched Vulnerability : CVE-2026-79016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-79059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain cross-origin da...

CVE-2026-54523: Missing Authorization

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.applynamespace, resources with an arbitrary...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

The Address Suggestion module provides address autocomplete functionality using configured address providers. The module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is...

Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

CVE-2026-54606: Improper Neutralization of Input During Web Page Generation

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...

CVE-2026-2388: Improper Neutralization of Input During Web Page Generation

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wpdisplay shortcode handler, used by multiple shortcodes, allowing attacker-controlled htmltags values to define raw HTML tags a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093171 advisory. GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against...

PT-2026-81959

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...

PT-2026-81941

Name of the Vulnerable Software and Affected Versions Katello affected versions not specified Description An authorization flaw exists in the Content View History API. An authenticated user with permissions to view Content Views within one organization can access the lifecycle history of a Conten...

CVE-2026-77317: Incorrect Authorization

SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

PT-2026-82359

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.3 Description An authenticated user with the role:reader role on any project can list all project-scoped role assignments under any domain. This occurs when a domain ID is passed as scope.project.id wi...

Linux Distros Unpatched Vulnerability : CVE-2026-78962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially leak cross-origin...

Linux Distros Unpatched Vulnerability : CVE-2026-78960

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a...

Linux Distros Unpatched Vulnerability : CVE-2026-78986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain...

Linux Distros Unpatched Vulnerability : CVE-2026-78896

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-79252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromiu...