PT-2026-85220

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

RHEL 9 : rhc (RHSA-2026:63130)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63130 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

AlmaLinux 8 : grafana (ALSA-2026:62407)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62407 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

RockyLinux 8 : grafana (RLSA-2026:62407)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62407 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

RHEL 10 : grafana (RHSA-2026:63022)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63022 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/mail:...

RockyLinux 9 : grafana (RLSA-2026:62406)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62406 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

PT-2026-85245

Name of the Vulnerable Software and Affected Versions MapLibre GL JS versions prior to 6.4.1 Description The DOM.sanitize function in src/util/dom.ts incorrectly iterates through elem.attributes as a live NamedNodeMap. Because removeAttributes modifies the same collection during iteration, indexe...

The vulnerability of the LibreNMS network monitoring system, related to the lack of protection for the website structure, allows attackers to perform cross-site scripting attacks (XSS) and increase their privileges.

The vulnerability of the LibreNMS network monitoring system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS and increase their privileges...

RHEL 9 : grafana-pcp (RHSA-2026:63136)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:63136 advisory. The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and...

Shifting from Injection to Interaction: Rethinking Web Security in the Age of LLMs and Beyond

Large language models LLMs are becoming integral to web applications and browser agents, transforming online interactions while introducing new attack vectors and reshaping longstanding web vulnerabilities. Classical threats such as cross-site scripting XSS can be amplified through LLM-mediated...

CVE-2026-81773: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...

CVE-2026-81281: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

CVE-2026-81295: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Under Construction = 5.82 versions...

CVE-2026-81292: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...

CVE-2026-85207: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly availab...

CVE-2026-84773: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

CVE-2026-84812: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.27 versions...

CVE-2026-84763: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in RTMKit = 2.1.5 versions...

CVE-2026-85022: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/shareLayout/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirecturl leads to cross...

CVE-2026-85021: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/shareLayout/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirecturl causes cross site scripting. The attack is possible to be carried o...