CVE-2026-42052

Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode for untrusted metadata fields. In this runtime, is raw insertion and HTML escaping is only performed by . Rendered output is then inserted with .html..., allowing...

oscovida (>=0.2.1, <=0.2.5), voila (>=0.1.8, <=0.1.24) +6 more potentially affected by CVE-2026-35397 via jupyter-server (0.1.1)

jupyter-server PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - oscovida =0.2.1, =0.1.8, =0.0.1, =0.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2026-35397 Source advisory:...

GHSA-G9CM-RXP7-6GV5 AVideo: HTML Injection in notifySubscribers.json.php Allows Platform-Branded Phishing Emails to Channel Subscribers

Summary objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail, which substitutes it directly into an HTML email template via strreplace on the message placeholder and renders it with PHPMailer::msgHTML. There is no HTML sanitization, character...

EUVD-2026-27404

ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting XSS in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied...

USN-8234-1 python-mako vulnerability

It was discovered that Mako incorrectly handled URIs with double-slash prefixes in TemplateLookup. A remote attacker could possibly use this issue to obtain sensitive information...

CVE-2026-38432

ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting XSS in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied...

CVE-2026-38431

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection SSTI. An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered...

oscovida (>=0.2.1, <=0.2.5), voila (>=0.1.8, <=0.1.24) +6 more potentially affected by CVE-2026-35397 via jupyter-server (0.1.1)

jupyter-server PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - oscovida =0.2.1, =0.1.8, =0.0.1, =0.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2026-35397 Source advisory:...

oscovida (>=0.2.1, <=0.2.5), voila (>=0.1.8, <=0.1.24) +6 more potentially affected by CVE-2025-61669 via jupyter-server (0.1.1)

jupyter-server PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - oscovida =0.2.1, =0.1.8, =0.0.1, =0.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2025-61669 Source advisory:...

CVE-2026-5957 EmailKit <= 1.6.5 - Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter

The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 1.6.5. This is due to a flawed path traversal validation in the createtemplate method of the CheckForm class, where realpath is called on the allowed base directory...

CVE-2026-5957

The CVE concerns the WordPress EmailKit plugin (versions up to and including 1.6.5). A path traversal flaw in CheckForm.php::create_template() uses realpath() on the allowed base directory (wp-content/uploads/emailkit/templates/), which may not exist, causing realpath() to return false. In PHP 8....

CVE-2026-38431

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection SSTI. An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered...

CVE-2026-38432

ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting XSS in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied...

CVE-2026-38431

ERPNext versions v15.103.1 and before are vulnerable to Server-Side Template Injection (SSTI) . An attacker with the permission to create or edit email templates can inject malicious template expressions. These expressions are then executed on the server during the template rendering process. To ...

CVE-2026-38432

ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting XSS in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied...

CVE-2026-38432: Improper Neutralization of Input During Web Page Generation

ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting XSS in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied...

CVE-2026-38431: Improper Control of Generation of Code

ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection SSTI. An attacker with permission to create or edit email templates can inject template expressions that are executed on the server when the template is rendered...

SUSE SLES16 Security Update : python-Mako (SUSE-SU-2026:21426-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:21426-1 advisory. This update for python-Mako fixes the following issue: - CVE-2026-41205: Prior to 1.3.11, TemplateLookup.gettemplate is vulnerable to path...

Linux Distros Unpatched Vulnerability : CVE-2026-42052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode for untrusted metadata...

CVE-2026-38432

ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting XSS in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that are executed on the victim's browser when the template is applied...