CVE-2026-36468

A Cross-site Scripting (XSS) vulnerability exists in the index.php component of CuteNews v.2.1.2 . The root cause is the improper neutralization of input during web page generation , which allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key. If this key contai...

CVE-2026-36468: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "...

PT-2026-104826

A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key sym map...

CVE-2026-94381: Improper Privilege Management

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permission...

CVE-2026-94097: Improper Neutralization of Special Elements used in a Command

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/networktools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possibl...

PT-2026-96101

Name of the Vulnerable Software and Affected Versions libX11 versions prior to 1.8.14 Description A buffer overflow exists in the handling of XkbGetMap, which can lead to an overflow of the key sym map. This issue allows a malicious X server to exploit the flaw. Recommendations Update libX11 to...

CVE-2026-36468

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

EUVD-2026-83990

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

CVE-2026-36468

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

PT-2026-96214

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description An issue exists where the POST /api/barcode/ endpoint accepts synthesized internal JSON barcodes containing a lowercase model label and an integer primary key. Because the BarcodeView only requires...

PT-2026-96255

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.2-lts Description The authentication process for the '/chat/api/mcp' endpoint fails to enforce is permanent and expire time checks when validating an ApplicationApiKey. It only verifies the secret and active status...

CVE-2026-91166: Improper Validation of Certificate with Host Mismatch

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

Key Reconciliation with RC-LDPC/Error Estimation for Satellite-Based FSO/QKD Systems

Satellite-based free-space optics FSO quantum key distribution QKD systems have recently attracted significant research interest due to their potential to enable globally secured applications. However, the inherent uncertainty of FSO channels, caused by weather conditions and satellite mobility,...

SUSE SLES15 Security Update : openssl-1_1-livepatches (SUSE-SU-2026:4037-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4037-1 advisory. This update for openssl-11-livepatches fixes the following issue: - CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788...

SUSE SLES15: libopenssl-1_1-devel / libopenssl-1_1-devel-32bit / libopenssl1_1 / etc (SUSE-SU-2026:4033-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4033-1 advisory. August 2026 release. - CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch bsc1274795. - CVE-2026-63072:...

SUSE SLED15: libopenssl-1_1-devel / libopenssl1_1 / libopenssl1_1-32bit / etc (SUSE-SU-2026:4041-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4041-1 advisory. August 2026 release. - CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch...

SUSE SLES12: libopenssl-1_1-devel / libopenssl-1_1-devel-32bit / libopenssl1_1 / etc (SUSE-SU-2026:4043-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4043-1 advisory. August 2026 release. - CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch bsc1274795. - CVE-2026-63072:...

SUSE SLES15 Security Update : openssl-1_1-livepatches (SUSE-SU-2026:4036-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4036-1 advisory. - CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788. - HollowByte: DoS vector against OpenSSL TLS ClientHello via remot...

SUSE SLES15 Security Update : openssl-1_1-livepatches (SUSE-SU-2026:4034-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4034-1 advisory. This update for openssl-11-livepatches fixes the following issue: - CVE-2026-63072: heap buffer overflow in CMS key unwrapping bsc1275133, bsc1274788...

SUSE SLES15 Security Update : openssl-3-livepatches (SUSE-SU-2026:4040-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4040-1 advisory. - CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate bsc1275145, bsc1274792. - CVE-2026-63072: heap...