PT-2026-82314

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.5 Description An authenticated reflected Cross-Site Scripting XSS issue exists in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a...

ALSA-2026:60304 Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...

ALSA-2026:60306 Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...

Important: golang security, bug fix, and enhancement update

The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098999)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098999 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: xtmultiport: validate range encoding in checkentry portsmatchv1 treats any non-zero...

RHEL 8 : go-toolset:rhel8 (RHSA-2026:60305)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60305 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: encoding/asn1:...

RHEL 10 : golang (RHSA-2026:60306)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60306 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servi...

CVE-2026-65085

NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-65085

NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-65085

NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

EUVD-2026-66103

NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-65085

NVIDIA OpenShell for Linux is affected by a vulnerability in its inference proxy component, caused by improper encoding or escaping of output . A successful exploit could lead to information disclosure and data tampering . The vulnerability has a CVSS 3.1 score of 5.2 (Medium) , with a local atta...

Security Bulletin: Vulnerability in Apache Log4j affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Apache Log4j has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

Improper Encoding or Escaping of Output

Overview eml-parser is a Python EML parser library Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the URL extraction process. An attacker can cause valid URLs containing HTML entities to be omitted from extraction by encoding characters such as :, /...

CVE-2026-55618

eml_parser is a Python module for parsing .eml files. Prior to 3.0.2 , the clean_found_uri function in parser.py validates potential URL strings before unescaping HTML entities for colon, slash, or period characters. As a result, valid encoded URLs and their hostnames are rejected and omitted fro...

Security Bulletin: Vulnerability in Apache Log4j affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Apache Log4j has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Apache Tomcat has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

CVE-2026-26211 Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the pa...

CVE-2026-26211 Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the pa...

CVE-2026-26211

Ekushey Project Manager CRM 5.0 is affected by a stored XSS vulnerability in the administrator-configured system name field. The value is written to the login page without output encoding, and its occurrence in an h4 element is parsed as markup, causing any injected HTML event handlers to execute...