ALSA-2026:69961 Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

The vulnerability of the Scripting components of the Oracle Java SE software platform allows attackers to gain unauthorized access to protected information.

The vulnerability of Oracle Java SE’s scripting components is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-96797

webpy web.py 0.76 is vulnerable to Cross Site Scripting XSS via render jinja. init...

CVE-2026-95396: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java of the component Public Search Handlers. The manipulation of the argument Search leads to cross site scripting. The attack can b...

PT-2026-96828

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description LightRAG WebUI is subject to stored cross-site scripting XSS because it renders assistant answer and thinking content as raw HTML without an HTML sanitizer. The application uses react-markdown...

PT-2026-97032

Name of the Vulnerable Software and Affected Versions CMSimple version 5.24 Description CSRF protection is disabled by default, rendering the csrfProtection function ineffective for state-changing admin requests and omitting the csrf token hidden field in admin forms. Since administrator...

RHEL 9 : podman (RHSA-2026:69961)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69961 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use...

Insufficient input sanitization of shell metacharacters in Brocade SANnav

Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090055)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090055 advisory. In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the modproxy error page. An attacker could cause the link on the erro...

RockyLinux 9 : osbuild-composer (RLSA-2026:69293)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69293 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

PT-2026-96970

Name of the Vulnerable Software and Affected Versions Adobe Connect affected versions not specified Description A stored Cross-Site Scripting XSS issue exists where an attacker can inject malicious scripts into vulnerable form fields. This allows malicious JavaScript to be executed in the browser...

CVE-2026-77272: Improper Neutralization of Input During Web Page Generation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler.sendresponse in oauthsetup.py and interpolated into an HTML page without escaping. A crafted authorization callback can...

CVE-2026-75510: Improper Neutralization of Input During Web Page Generation

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

PT-2026-96986

Name of the Vulnerable Software and Affected Versions Adobe Connect affected versions not specified Description A stored Cross-Site Scripting XSS issue exists where an attacker can inject malicious scripts into vulnerable form fields. When a victim visits the page containing the affected field, t...

ALSA-2026:70201 Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint...

Important: containernetworking-plugins security update

The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...

ALSA-2026:70391 Important: containernetworking-plugins security update

The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...

CVE-2026-94426 xuxueli xxl-job insert cross site scripting

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...