CVE-2026-103050: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1739387851)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739387851 advisory. - URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue affects...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752087722)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752087722 advisory. - The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1769515411)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1769515411 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the...

PT-2026-103505

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3...

aap-client-python (>=0.1.1, <=0.1.3), gcb-web-auth (>=0.6.0, <=2.0.0) +4 more potentially affected by CVE-2026-102269 via pyjwt (1.5.2)

pyjwt PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aap-client-python =0.1.1, =0.6.0, =0.2775.0, =0.3.0, =0.0.1, =4.0.0, =4.0.1 Source cves: CVE-2026-102269 Source advisory: OSV:GHSA-HXM8-2XGR-2P9M...

aap-client-python (>=0.1.1, <=0.1.3), gcb-web-auth (>=0.6.0, <=2.0.0) +4 more potentially affected by CVE-2026-102267 via pyjwt (1.5.2)

pyjwt PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aap-client-python =0.1.1, =0.6.0, =0.2775.0, =0.3.0, =0.0.1, =4.0.0, =4.0.1 Source cves: CVE-2026-102267 Source advisory: OSV:GHSA-9V7F-9G4P-FFGJ...

CVE-2026-103051 Stored i18n XSSs in CentralNotice

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103051 Stored i18n XSSs in CentralNotice

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103051

The MediaWiki CentralNotice extension is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. An attacker can inject malicious code into stored application notices, which executes in a user's web browser when they view the affected page....

aap-client-python (>=0.1.1, <=0.1.3), gcb-web-auth (>=0.6.0, <=2.0.0) +4 more potentially affected by CVE-2026-101917 via pyjwt (1.5.2)

pyjwt PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aap-client-python =0.1.1, =0.6.0, =0.2775.0, =0.3.0, =0.0.1, =4.0.0, =4.0.1 Source cves: CVE-2026-101917 Source advisory: OSV:GHSA-2GX3-RCP4-G85Q...

CVE-2026-103050

The Wikimedia Foundation Mediawiki - MassMessage extension is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to the improper neutralization of input during web page generation. This issue specifically affects versions before 1.46.1, 1.45.5, and 1.43.10 . Documentation indicates this i...

CVE-2026-103050 Stored i18n XSS in MassMessage

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-18105 Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-18105 Fireware OS Uncontrolled Resource Consumption in Diagnostic Tasks Allows Denial of Service

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-18105

A vulnerability in Fireware OS allows a low-privileged, authenticated user to cause a denial of service (DoS) of the system's diagnostic tools. The root cause is an uncontrolled resource consumption flaw within the diagnostic tasks feature. An attacker can trigger this by repeatedly starting and ...

CVE-2026-103045 XSS in Refreshed skin

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103045 XSS in Refreshed skin

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-70356 Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-94952

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT NTR150 firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw port-forwarding configuration handler and is triggered by the ipsubnet and fwip request parameters during th...