PT-2026-96797

webpy web.py 0.76 is vulnerable to Cross Site Scripting XSS via render jinja. init...

PT-2026-96828

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description LightRAG WebUI is subject to stored cross-site scripting XSS because it renders assistant answer and thinking content as raw HTML without an HTML sanitizer. The application uses react-markdown...

CVE-2026-95396: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java of the component Public Search Handlers. The manipulation of the argument Search leads to cross site scripting. The attack can b...

RockyLinux 9 : osbuild-composer (RLSA-2026:69293)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69293 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

RHEL 9 : podman (RHSA-2026:69961)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69961 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use...

PT-2026-97032

Name of the Vulnerable Software and Affected Versions CMSimple version 5.24 Description CSRF protection is disabled by default, rendering the csrfProtection function ineffective for state-changing admin requests and omitting the csrf token hidden field in admin forms. Since administrator...

CVE-2026-77272: Improper Neutralization of Input During Web Page Generation

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler.sendresponse in oauthsetup.py and interpolated into an HTML page without escaping. A crafted authorization callback can...

CVE-2026-75510: Improper Neutralization of Input During Web Page Generation

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

ALSA-2026:70391 Important: containernetworking-plugins security update

The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...

ALSA-2026:70201 Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint...

PT-2026-96986

Name of the Vulnerable Software and Affected Versions Adobe Connect affected versions not specified Description A stored Cross-Site Scripting XSS issue exists where an attacker can inject malicious scripts into vulnerable form fields. When a victim visits the page containing the affected field, t...

Important: containernetworking-plugins security update

The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...

PT-2026-96970

Name of the Vulnerable Software and Affected Versions Adobe Connect affected versions not specified Description A stored Cross-Site Scripting XSS issue exists where an attacker can inject malicious scripts into vulnerable form fields. This allows malicious JavaScript to be executed in the browser...

CVE-2026-94426 xuxueli xxl-job insert cross site scripting

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

Important: Red Hat Security Advisory: Red Hat Data Grid 8.6.3 security update

An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2026-94211 Hyve5 Leantime Project Dashboard show.blade.php cross site scripting

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remot...

CVE-2026-94150 Omega Solution HRM OS SVG File Upload view cross site scripting

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-94210: Improper Neutralization of Input During Web Page Generation

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. Th...