Linux Distros Unpatched Vulnerability : CVE-2026-100765

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

Linux Distros Unpatched Vulnerability : CVE-2026-100792

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird...

Linux Distros Unpatched Vulnerability : CVE-2026-102414

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than t...

PT-2026-103538

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description A stored cross-site scripting XSS weakness allows an authenticated user to submit content that executes arbitrary JavaScript in the session of another user who views that content. This can be...

Linux Distros Unpatched Vulnerability : CVE-2026-97711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values...

Linux Distros Unpatched Vulnerability : CVE-2026-100788

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird...

CVE-2026-103388: Improper Neutralization of Input During Web Page Generation

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTERVALIDATEURL validation. Because FILTERVALIDATEURL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could...

PT-2026-103081

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description Reflected Cross-site Scripting occurs when an application includes untrusted data in a web page without proper validation or encoding. Unauthenticated remote attackers can execute...

PT-2026-103629

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.0 Description A reflected cross-site scripting issue exists in the back-office room type editor's length of stay fields. Authenticated administrators can be induced to submit crafted POST requests containing...

CVE-2026-102100: Improper Neutralization of Input During Web Page Generation

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting XSS weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated...

CVE-2026-92994: Improper Neutralization of Input During Web Page Generation

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript...

PT-2026-103287

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER VALIDATE URL validation. Because FILTER VALIDATE URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance coul...

CVE-2026-103321: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

AlmaLinux 9.2 [TuxCare] Security Update: containernetworking-plugins (ALMALINUX9.2:CLSA-2025:1762181347)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762181347 advisory. - Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the...

AlmaLinux 9.2 [TuxCare] Security Update: jsoup / jsoup-javadoc (ALMALINUX9.2:CLSA-2026:1784880925)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784880925 advisory. - jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting XSS safety. jsoup may incorrectly sanitiz...

SUSE CVE-2026-100765

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

SUSE CVE-2026-100769

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...

SUSE CVE-2026-100776

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...

SUSE CVE-2026-100788

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...

SUSE CVE-2026-100792

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...