MiracleLinux 8 : [security - high] nodejs:24 (AXSA:2026-1352:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1352:01 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

Important: docker

Issue Overview: Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt ...

CVE-2026-17496

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...

CVE-2026-17497 NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...

EUVD-2026-49055

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...

CVE-2026-17496 NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...

CVE-2026-17496

NoteGen prior to 0.32.0 renders AI chat responses using markdown-it with html:true and injects output into the chat-preview DOM via dangerouslySetInnerHTML without HTML sanitization and with CSP set to null. Attackers can inject content (e.g., a malicious REFERENCE.md) that instructs the model to...

Nagios XI < 5.8.6 - Cross-Site Scripting

In Nagios XI before 5.8.6, XSS exists in the dashboard page /dashboards/ when administrative users attempt to edit a dashboard. id: CVE-2021-38156 info: name: Nagios XI 5.8.6 - Cross-Site Scripting author: ritikchaddha severity: medium description: | In Nagios XI before 5.8.6, XSS exists in the...

twitter-server Cross-Site Scripting

twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. id: CVE-2020-35774 info: name: twitter-server Cross-Site...

PT-2026-64811

Name of the Vulnerable Software and Affected Versions NoteGen versions prior to 0.32.0 Description Cross-site scripting occurs when AI chat responses are rendered using markdown-it with the html:true configuration and injected into the DOM via dangerouslySetInnerHTML in the chat-preview component...

Cross-site Scripting (XSS)

n8n is vulnerable to Cross-site Scripting XSS. The vulnerability is due to rendering HTML preview content in an iframe without the sandbox attribute and a sanitizer bypass, which allows an attacker with global member privileges to execute malicious scripts and perform authenticated actions using ...

Cross-site Scripting (XSS)

DOMPurify is vulnerable to Cross-site Scripting XSS. The vulnerability is due to failure to execute the afterSanitizeElements hook for custom elements allowed through CUSTOMELEMENTHANDLING.tagNameCheck, allowing sensitive attributes to bypass sanitization and be reused in innerHTML sinks to execu...

CVE-2026-15425

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15425

The CVE concerns the Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress (Yoast SEO) vulnerable to Stored Cross-Site Scripting via the Post Slug (post_name) feature. Affected versions: all up to and including 28.0. Root cause: insufficient input sanitization and ...

CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-48765

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15425

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-64475

Name of the Vulnerable Software and Affected Versions Yoast SEO versions prior to 28.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access or higher can inject arbitrary web scripts into pages...

Linux Distros Unpatched Vulnerability : CVE-2026-65904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's...