Linux Distros Unpatched Vulnerability : CVE-2026-72708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject...

CVE-2026-81918

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with editpagecontents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...

EUVD-2026-76690

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with editpagecontents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...

CVE-2026-81918 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with editpagecontents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...

CVE-2026-81918

Concrete CMS versions below 9.5.3 are affected by a Stored XSS vulnerability in the Date Format field of the Page Attribute Display block . A user holding edit_page_contents permissions can store a payload that executes in the browser of any visitor who views a page where the block is configured ...

CVE-2026-81918 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with editpagecontents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...

CVE-2026-81918 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with editpagecontents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...

CVE-2026-72708

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...

UBUNTU-CVE-2026-72708

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...

CVE-2026-72708

SPIP before 4.4.18 is affected by an unauthenticated blind SQL injection in the public sitemap endpoint. The root cause lies in the MySQL escaper spip_mysql_cite() (in ecrire/req/mysql.php), which returns values unescaped when the target column is a date type and the input matches a word characte...

ROOT-OS-DEBIAN-12-CVE-2026-14741 CVE-2026-14741 in libhttp-date-perl - Patched by Root

Root has patched CVE-2026-14741 in the libhttp-date-perl package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-14741 CVE-2026-14741 in libhttp-date-perl - Patched by Root

Root has patched CVE-2026-14741 in the libhttp-date-perl package for Root:Debian:13. Multiple fixed versions available...

PT-2026-89911

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where the MySQL escaper spip mysql cite in ecrire/req/mysql.php returns values unescaped when the target column is a date type and the supplied value matches the pattern of a word...

PT-2026-90499

Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user with edit page contents permissions could store a payload which executes in the browser of any visitor who viewed a page where the block was configured to display a date-type...

PT-2026-89588

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLE USER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-86255

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the datesequence computation via routine detail endpoints, forcing the server to iterate thousands of times per...

EUVD-2026-72111

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the datesequence computation via routine detail endpoints, forcing the server to iterate thousands of times per...

PT-2026-86524

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date sequence computation via routine detail endpoints, forcing the server to iterate thousands of times per...

Malicious Package

Overview guci-date is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

DRUPAL-CONTRIB-2026-133

This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A separate PHP fatal error issue may prevent exploitation in practice on Drupal 10+...