https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:06:26 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-5160 <p><strong>Affected:</strong> Alpaquita:25: osv-scanner, Alpaquita:stream: osv-scanner</p> <p><strong>Affected:</strong> Alpaquita:25: osv-scanner, Alpaquita:stream: osv-scanner</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-5160 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0486 certfr-2026-avi-0486 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0486 https://cve.radiocsirt.org/vuln/cleanstart-2026-qg09964 <p><strong>Affected:</strong> CleanStart: crossplane-provider-keycloak, CleanStart: pulumi</p> <p>CVE-2026-5160 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: crossplane-provider-keycloak, CleanStart: pulumi</p> <p>CVE-2026-5160 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-qg09964 https://cve.radiocsirt.org/vuln/euvd-2026-291489 EUVD-2026-291489 https://cve.radiocsirt.org/vuln/euvd-2026-291489 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5160 <p>Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&amp;colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.</p> <p>Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&amp;colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-5160 https://cve.radiocsirt.org/vuln/ghsa-c97m-vxhj-p7j6 <p><strong>Affected:</strong> Go: github.com/yuin/goldmark/renderer/html</p> <p>Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&amp;colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.</p> <p><strong>Affected:</strong> Go: github.com/yuin/goldmark/renderer/html</p> <p>Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&amp;colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.</p> https://cve.radiocsirt.org/vuln/ghsa-c97m-vxhj-p7j6 https://cve.radiocsirt.org/vuln/msrc_cve-2026-5160 msrc_CVE-2026-5160 https://cve.radiocsirt.org/vuln/msrc_cve-2026-5160 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11366-1 <p>mcphost-0.34.0-9.1 on GA media</p> <p>mcphost-0.34.0-9.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11366-1 https://cve.radiocsirt.org/vuln/suse-su-2026:22994-1 <p>Security update for mcphost</p> <p>Security update for mcphost</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22994-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-5160 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: golang-github-yuin-goldmark, Ubuntu:22.04:LTS: golang-github-yuin-goldmark, Ubuntu:24.04:LTS: golang-github-yuin-goldmark, Ubuntu:25.10: golang-github-yuin-goldmark, Ubuntu:26.04:LTS: golang-github-yuin-goldmark</p> <p>Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&amp;colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: golang-github-yuin-goldmark, Ubuntu:22.04:LTS: golang-github-yuin-goldmark, Ubuntu:24.04:LTS: golang-github-yuin-goldmark, Ubuntu:25.10: golang-github-yuin-goldmark, Ubuntu:26.04:LTS: golang-github-yuin-goldmark</p> <p>Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&amp;colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-5160