CVE-2026-96450: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in pixfort Core 4.3.3 versions...

CVE-2026-102586: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

CVE-2026-88037: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title attribute of the btbbservice shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

CVE-2026-97266: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12.1 versions...

PT-2026-103288

MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...

CVE-2026-96819: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in oik = 4.15.4 versions...

CVE-2026-93464: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

PT-2026-102995

A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes...

PT-2026-103261

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

CVE-2026-103439: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting XSS. This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43...

CVE-2026-97262: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...

PT-2026-103234

Subscriber Cross Site Scripting XSS in JetEngine = 3.8.14.3 versions...

CVE-2026-97067: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.7 versions...

PT-2026-103249

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...

CentOS Linux 6 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ssl Multiple Vulnerabilities (CENTOS6:CLSA-2026:1781623309)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1781623309 advisory. - A cross-site scripting vulnerability exists in modproxyftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier...

AlmaLinux 8 : container-tools:rhel8 (ALSA-2026:63163)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:63163 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 encoding/asn1: golang: Go encoding/asn1: Denial of...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc (ALMALINUX9.2:CLSA-2025:1753121138)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753121138 advisory. - A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2,...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1781209763)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1781209763 advisory. - Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration This issue affects Apache HTTP...

CVE-2026-71189 Toptech TMS7 and TopHAT Cross-site Scripting

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application...

CVE-2026-71189

The Toptech TMS7 and TopHAT platforms are vulnerable to a Cross-site Scripting (XSS) vulnerability. An attacker can construct a malicious request that, when triggered by another application user, executes arbitrary JavaScript code within the user's browser session. The provided documents do not s...