PT-2026-104196

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”...

PT-2026-104161

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected – endpoint...

CVE-2026-59669: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”...

PT-2026-104195

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoint “/es/origins/store”...

CVE-2026-59666: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomOrigen” parameter is affected – endpoint “/es/origins/store”...

PT-2026-104189

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”...

PT-2026-104173

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomGrupoEmpresarial” parameter is affected – endpoint "/es/corporategroups/update/246”...

CVE-2026-59672: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomGrupoEmpresarial” parameter is affected – endpoint "/es/corporategroups/update/246”...

PT-2026-104191

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomServicioPrestado” parameter is affected – endpoint “/es/providedservices/store”...

CVE-2026-59661: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomRuta” parameter is affected – endpoint “/es/routes/update/693”...

PT-2026-104197

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizebills/store”...

PT-2026-104172

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomRuta” parameter is affected – endpoint “/es/routes/update/693”...

Security Bulletin: IBM Optim 1.1.0 impacted by vulnerability in lodash-es 4.17.21

Summary IBM Optim 1.1.0 includes lodash-es 4.17.21 as an npm dependency in the archon-ui component. This version is affected by CVE-2025-13465, a prototype pollution vulnerability that allows a remote attacker to manipulate JavaScript object prototypes via specially crafted input, potentially...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: ext4: fixed the bug in estreesearch Hulk Robot reported a BUG: kernel BUG at fs/ext4/extentsstatus.c:199! ... RIP: 0010:ext4esend fs/ext4/extentsstatus.c:199 inline RIP: 0010:estreesearch+0x1e0/0x260 fs/ext4/extentsstatus.c:21...

Elasticsearch 8.11.x < 8.18.0 DoS (ESA-2026-111)

The version of Elasticsearch installed on the remote host is 8.11.x prior to 8.18.0. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-111 advisory. - Memory Allocation with Excessive Size Value CWE-789 in the ES|QL query processing of Elasticsearch can lead to denial of...

Malicious Package

Overview chalk-es is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

BIT-ELASTICSEARCH-2026-72656 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Memory Allocation with Excessive Size Value CWE-789 in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amou...

PT-2026-78816

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description A user with the get talos enrichment capability can send a crafted request to the Talos intelligence enrichment REST API endpoint, forcing the instance ...

PT-2026-79864

Memory Allocation with Excessive Size Value CWE-789 in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amou...

Malicious code in chalk-es (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc Package name mimics chalk but ships an empty library body; the only real behavior lives in scripts/postinstall.js. On install the script XOR-decodes...