PT-2026-103809

Name of the Vulnerable Software and Affected Versions Ghost versions 2.5.0 through 6.33.x Description The oEmbed preview feature fails to sandbox externally hosted scripts, allowing for untrusted script execution. An attacker can create malicious oEmbed content to execute scripts within the...

CVE-2026-96659: Privilege Defined With Unsafe Actions

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

CVE-2026-103277: Improper Neutralization of Input During Web Page Generation

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

CVE-2026-103532: Improper Authorization

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...

PT-2026-103945

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Red Hat Satellite versions 6.16 through 6.19 Description An authenticated user with low-level Viewer permissions can cause unauthorized information disclosure by submitting requests to template preview...

PT-2026-105872

Summary Any authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. The in-app port preview rendered the content of a previewed port in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, a...

PT-2026-103656

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...

AlmaLinux 9.6 [TuxCare] Security Update: exiv2 / exiv2-devel / exiv2-doc / exiv2-libs (ALMALINUX9.6:CLSA-2026:1775221560)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775221560 advisory. - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to versio...

Rocky Linux 9.6 [TuxCare] Security Update: exiv2 / exiv2-devel / exiv2-doc / exiv2-libs (ALMALINUX9.6:CLSA-2026:1775221560)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1775221560 advisory. - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to...

AlmaLinux 9.2 [TuxCare] Security Update: exiv2 / exiv2-devel / exiv2-doc / exiv2-libs (ALMALINUX9.2:CLSA-2026:1777455968)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777455968 advisory. - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to versio...

AlmaLinux 9.2 [TuxCare] Security Update: exiv2 / exiv2-devel / exiv2-doc / exiv2-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1774266713)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1774266713 advisory. - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior ...

Rocky Linux 9 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_9302)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249302 advisory. emacs: Gnus treats inline MIME contents as trusted CVE-2024-30203 emacs: LaTeX preview is enabled by default for e-mail attachments CVE-2024-30204 emacs: O...

CVE-2026-100272

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues...

EUVD-2026-90016

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues...

CVE-2026-100272

In JetBrains YouTrack versions before 2026.2.19197 , a lack of missing authorisation in the notification template preview feature allows Project Administrators to read restricted issues . The impact is categorized as High for confidentiality. Remediation is available in version 2026.2.19197 or la...

CVE-2026-100272

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues...

CVE-2026-103321

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

CVE-2026-103321 MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

EUVD-2026-89800

MISP contains a stored cross-site script XSS vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was rendered into an HTML img element's src attribute via string...

CVE-2026-103321

MISP versions prior to the fix (applied after v2.5.48 ) are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability in the event graph preview feature. The root cause is a lack of server-side validation for the preview image field; the application renders this stored value into an HTML im...