plone.app.dexterity has a Denial of Service due to excessive title or description length

ImpactWhen creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. PatchesThe problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to plone.app.dexterit...

PYSEC-2026-4137 plone.app.dexterity has a Denial of Service due to excessive title or description length

Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...

CVE-2026-7173

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...

CVE-2026-7173 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...

EUVD-2026-90743

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...

CVE-2026-7173

The Entradium platform by Crocantickets contains Cross-Site Scripting (XSS) vulnerabilities. A Stored XSS exists in the City parameter of the /events//edit_general endpoint, allowing JavaScript injection that executes on an event's public page when editing events assigned to a promoter. Additiona...

CVE-2026-7173 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...

AlmaLinux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc (ALMALINUX9.6:CLSA-2026:1780510989)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780510989 advisory. - A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with...

PT-2026-105859

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's help text, which is rendered with Django's |safe filter render field.html, bypassing auto-escaping. In both...

OESA-2026-4138 cups security update

CUPS is the standards-based, open source printing system developed by Apple Inc. for UNIX®-like operating systems. CUPS uses the Internet Printing Protocol IPP to support printing to local and network printers.. Security Fixes: The cupsUTF32ToUTF8 function in CUPS's cups/transcode.c lacks a...

CentOS Linux 8.4 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS8.4:CLSA-2026:1780478501)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1780478501 advisory. - A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with...

CentOS Linux 7 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS7:CLSA-2026:1780662711)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1780662711 advisory. - A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the...

CVE-2026-100238

The Wikimedia Foundation Mediawiki - Flow Extension is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the flow colon-separator and flow-guidedtour-optin-welcome-description messages allow for the injection of malic...

CVE-2026-100238 Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100238 Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-102372

Versions of GestSup prior to 3.2.62 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw within the IMAP LOGIN connector . The root cause is a failure to properly sanitize HTML email bodies, which allows unauthenticated attackers to inject arbitrary JavaScript into ticket descriptions and r...

CVE-2026-97564: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

openSUSE 16: cups / cups-client / cups-config / cups-ddk / cups-devel / libcups2 / etc (openSUSE-SU-2026:21893-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21893-1 advisory. This update for cups fixes the following issue: - CVE-2026-87875: heap out-of-bounds read in cupsUTF32ToUTF8 due to missing source-length bound can be...

CVE-2026-48543

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

EUVD-2026-86448

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...