Rocky Linux 9 [CIQ] Security Update: gcc-toolset-13-gcc / gcc-toolset-13-gcc-c++ / etc (crlsa-2025_1309)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20251309 advisory. jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023 Tenable has extracted the preceding description block directly fr...

CLEANSTART-2026-HZ31792 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the crane package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-PB65186 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the crane package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CVE-2026-103437

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

GHSA-97JJ-33GV-5XF9 league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

Summary The DisallowedRawHtml extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just /i The trailing character class requires one character after the tag name. The block parser does not: RegexHelper::PARTIALHTMLBLOCKOPEN...

CVE-2026-90333

A flaw was found in the Linux kernel's device-mapper integrity dm-integrity target. This vulnerability allows an attacker with raw write access to the backing device, but without the integrity key, to bypass data integrity checks. By stamping any block with a specially crafted discard filler tag,...

CVE-2026-103239

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

EUVD-2026-89761

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103239

The MISP platform is vulnerable to a privilege escalation flaw in the tag collection creation and editing functionality (versions

CVE-2026-103239

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103239 MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103239 MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

Malicious Package

Overview @rutxploit-sec/subsplash-google-tag-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

CLEANSTART-2026-BD94423 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

Security vulnerability affects the minio-operator package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...

CLEANSTART-2026-MY04156 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the minio-operator package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

PT-2026-103117

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CVE-2026-103584: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting XSS. This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43...

CVE-2026-103239: Improper Access Control

MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any...

CentOS Linux 8.4 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS8.4:CLSA-2026:1781081927)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1781081927 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS6:CLSA-2026:1787083167)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1787083167 advisory. - Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file...