TencentOS Server 3: xmlrpc-c (TSSA-2026:1119)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1119 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

EulerOS 2.0 SP13 : xmlrpc-c (EulerOS-SA-2026-4206)

According to the versions of the xmlrpc-c packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page...

TencentOS Server 3: grafana (TSSA-2026:1139)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1139 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Rocky Linux 9.6 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (ALMALINUX9.6:CLSA-2026:1791818373)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791818373 advisory. - Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content whe...

TencentOS Server 3: container-tools:rhel8 (TSSA-2026:1154)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1154 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PT-2026-110980

Name of the Vulnerable Software and Affected Versions Netcore NR268 version 1.7.121109 Description Cross site scripting occurs in the DHCP Hostname Handler component due to the improper handling of the Hostname argument within the eval function of the 'filter hosts dump.cgi' endpoint. This allows...

PT-2026-110619

Name of the Vulnerable Software and Affected Versions Netis WF2409E version 3.3.42541 Description A remote cross-site scripting issue exists within the Wireless Settings component. This occurs when the SSID argument is manipulated, allowing an attacker to execute malicious scripts in the context ...

CVE-2026-109565: Improper Neutralization of Input During Web Page Generation

Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through self-registered display names. Attackers can register with an HTML or JavaScript name rendered unescaped in the Activity log Author filter,...

CVE-2023-54408: Improper Neutralization of Input During Web Page Generation

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling...

CVE-2025-27897: Improper Neutralization of Input During Web Page Generation

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

PT-2026-110891

Name of the Vulnerable Software and Affected Versions IBM Db2 Recovery Expert for Linux, UNIX and Windows version 5.5 IF 2 Description An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI. This cross-site scripting issue allows the attacker to alter intended functionality...

CVE-2025-71432: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted UR...

PT-2026-110998

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 13.46.1 Frappe versions prior to 14.20.0 Description Authenticated attackers can execute scripts in the browsers of users who view rendered content. This occurs because the html2text function weakly sanitizes...

PT-2026-111090

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description An authenticated user can embed arbitrary JavaScript code into the Web UI. This stored cross-site scripting issue allows for the alteration of intended functionality, which could...

PT-2026-110981

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description A remote cross site scripting issue exists in the /goform/formFilter file. This occurs when an unknown function within that file fails to properly handle input, allowing an attacker to execute maliciou...

PT-2026-110964

Name of the Vulnerable Software and Affected Versions Netcore NR268 version 1.7.121109 Description Cross site scripting occurs in the DHCP Handler component when the eval function in the dhcp dynamicip show.cgi file improperly handles the Hostname argument. This allows a remote attacker to execut...

PT-2026-110532

Name of the Vulnerable Software and Affected Versions Tuleap Enterprise Edition versions 17.0 through 17.5 Description A Stored Cross-site Scripting XSS issue exists, which could allow an attacker to execute arbitrary script code within the browser session of a user. Stored XSS occurs when a...

CVE-2026-108478: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8...

PT-2026-110518

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3...

PT-2026-110516

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18...