Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-1945)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1945 advisory. Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throug...

Debian dsa-6391 : roundcube - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6391 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6391-1 [email protected] https://www.debian.org/securit...

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update (Important) (RHSA-2026:42080)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42080 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

RHEL 8 : nodejs:22 (RHSA-2026:41947)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41947 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

RockyLinux 8 : nodejs:22 (RLSA-2026:41947)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41947 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

PT-2026-61578

SurrealDB before v2.6.1 and before v3.0.0-beta.3 contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability disabled by default. Any user able to execute arbitrary queries — including unauthenticated guests when...

MAL-2026-10782 Malicious code in zoom-widget-xss-poc-paresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12586eeb5b7eb0c053d90b49fd966fe32f05fe1f551cfd36120de1ce25b34fea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-45138

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...

EUVD-2026-45875

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom htmlpurify validation rule used to sanitize blog post bodies relies on by-reference mutation ?string &$str, but CodeIgniter 4's validator passes a local copy of the value, so the sanitized tex...

CVE-2026-45138

CVE-2026-45138 affects CI4MS (CodeIgniter 4-based CMS skeleton). Before 0.31.9.0, html_purify sanitization mutates the value by reference, but CodeIgniter’s validator uses a copy, causing sanitized text to be discarded. The Blog controller writes raw content to blog_langs and the public post temp...

CVE-2026-16229

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

CVE-2026-16229

The CVE reports a cross-site scripting (XSS) flaw in itsourcecode Courier Management System up to version 1.0. The vulnerability affects an unknown functionality of the file /index.php, where manipulating the argument page can trigger XSS. It is exploitable remotely, and an exploit has been publi...

CVE-2026-16229 itsourcecode Courier Management System index.php cross site scripting

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

CVE-2026-16229

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

CVE-2026-16220

A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to t...

CVE-2026-16220

A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to t...

EUVD-2026-45431

A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to t...

CVE-2026-16220

CVE-2026-16220 affects code-projects Online Examination System 1.0. The vulnerability resides in unknown code handling the parameter eid/n/t in /account.php?q=quiz, enabling cross-site scripting through manipulation of that argument. Impact details stated include remote feasibility with low to mo...

CVE-2026-16220 code-projects Online Examination System account.php cross site scripting

A vulnerability has been found in code-projects Online Examination System 1.0. This vulnerability affects unknown code of the file /account.php?q=quiz. Such manipulation of the argument eid/n/t leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to t...

CVE-2026-16205

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialcharsdecode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible ...