290177 matches found
Rocky Linux 9 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc (crlsa-2026_19186)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202619186 advisory. github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption JWE object CVE-2026-34986 Tenable has...
PT-2026-105789
Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...
CVE-2026-102394: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...
PT-2026-103744
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...
PT-2026-105178
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max frame size nor login timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small...
CVE-2026-78249: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...
Linux Distros Unpatched Vulnerability : CVE-2026-102320
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin...
PT-2026-103847
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.8.4...
Rocky Linux 9.6 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.6:CLSA-2026:1777545654)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777545654 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent...
RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 6.2.5 (RHSA-2026:73981)
The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73981 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised ...
Linux Distros Unpatched Vulnerability : CVE-2026-102329
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted...
CVE-2026-47096
AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...
CVE-2026-47096 AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter
AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...
CVE-2026-47096
AJA HELO Plus firmware versions before 2.1.7 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is an unsanitized eParamID_SystemName value accepted through the /config?action=set web configuration API. Unauthenticated attackers with network access can inject malicious Jav...
CVE-2026-103432
A flaw was found in apcupsd. A remote attacker could exploit a stack-based buffer overflow vulnerability in the web monitoring interface by supplying specially crafted data during variable parsing. A successful attack could allow the attacker to execute arbitrary code on the system or cause a...
CVE-2026-49264 vulnerabilities
Vulnerabilities for packages: dagster-fips, ansible-operator-fips, jupyter-base-notebook, kserve, kserve-models-web-app, openstack-keystone-2026.1-fips, chroma, kserve-xgbserver, pgadmin4-fips, authentik-fips, dagster, dask-kubernetes-fips, datadog-agent-fips, mlrun,...
GHSA-HJ66-6F7G-4R5V vulnerabilities
Vulnerabilities for packages: dagster-fips, ansible-operator-fips, jupyter-base-notebook, kserve, kserve-models-web-app, openstack-keystone-2026.1-fips, chroma, kserve-xgbserver, pgadmin4-fips, authentik-fips, dagster, dask-kubernetes-fips, datadog-agent-fips, mlrun,...
CVE-2026-49264 vulnerabilities
Vulnerabilities for packages: ggshield, kubeflow-volumes-web-app, datadog-agent, kubeflow-pipelines-visualization-server, kubeflow-jupyter-web-app, dask-kubernetes, kubeflow-pipelines, k8s-sidecar, az, open-webui, kserve, kubeflow-katib, jupyter-base-notebook...
GHSA-HJ66-6F7G-4R5V vulnerabilities
Vulnerabilities for packages: ggshield, kubeflow-volumes-web-app, datadog-agent, kubeflow-pipelines-visualization-server, kubeflow-jupyter-web-app, dask-kubernetes, kubeflow-pipelines, k8s-sidecar, az, open-webui, kserve, kubeflow-katib, jupyter-base-notebook...
webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption
A flaw was found in WebKitGTK. Processing maliciously crafted web content can trigger a use-after-free due to improper memory management, leading to memory corruption...