ALSA-2026:63119 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME head...

ALSA-2026:63136 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive...

ALSA-2026:63124 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME head...

RockyLinux 9 : grafana (RLSA-2026:62406)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62406 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

PT-2026-85110

Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...

PT-2026-85104

Unauthenticated Cross Site Scripting XSS in RTMKit = 2.1.5 versions...

PT-2026-85088

Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...

PT-2026-85086

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

PT-2026-85091

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...

PT-2026-85111

Unauthenticated Cross Site Scripting XSS in WP Statistics = 14.16.11 versions...

PT-2026-84900

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/shareLayout/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect url causes cross site scripting. The attack is possible to be carried...

PT-2026-85027

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0...

PT-2026-84901

A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/shareLayout/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirect url leads to cros...

PT-2026-85105

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

CVE-2026-81292: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...

MiracleLinux 9 : xmlrpc-c-1.51.0-17.el9_8 (AXSA:2026-1743:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1743:01 advisory. xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component CVE-2026-15928 Tenable has extracted the preceding description block directly from t...

Roundcube Webmail 1.6.x < 1.6.18 / 1.7.x < 1.7.3 Multiple Vulnerabilities

The remote web server is running Roundcube Webmail version 1.6.x prior to 1.6.18 or 1.7.x prior to 1.7.3. It is, therefore, affected by multiple vulnerabilities: - The cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This iss...

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

Summary @dicebear/core builds avatar SVGs from caller-supplied options. The numeric rotate option is interpolated into an SVG transform attribute without XML-escaping. It is typed as a number, but nothing checks the type at runtime, so a string value passes straight through and can break out of t...

burp-intruder-payloads

Burp Intruder Payloads You're welcome, hacker! About T...

WordPress Divi theme <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Theme Divi versions = 4.27.6...