CVE-2026-96258 is a cross-site scripting (XSS) vulnerability in onSite internet GmbH Auktion NG Auktionssoftware affecting the /forgotpasswd.html page's email parameter. This vulnerability allows remote attackers to inject malicious scripts via the email argument in the public password reset endpoint. The vulnerability is present in versions up to 20260722. The vendor was contacted but did not respond, and no patch or remediation information is currently available. The vulnerability has a medium severity with a CVSS score of 5.3. Exploit details have been publicly disclosed but no known active exploitation in the wild has been reported.

A cross-site scripting vulnerability exists in onSite internet GmbH Auktion NG Auktionssoftware up to version 20260722 in the /forgotpasswd.html file within the public password reset endpoint. The vulnerability arises from improper sanitization of the email parameter, allowing remote attackers to inject malicious scripts. The vendor has not provided a response or patch, and the exploit has been publicly disclosed. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on integrity and availability.

CVE Database V5

Detailed information about CVE-2026-96258: Cross Site Scripting in onSite internet GmbH Auktion NG Auktionssoftware affecting onSite internet GmbH Auktion NG Au

CVE-2026-96258: Cross Site Scripting in onSite internet GmbH Auktion NG Auktionssoftware - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-96258: Cross Site Scripting in onSite internet GmbH Auktion NG Auktionssoftware

CVE-2026-96257 is a critical stack-based buffer overflow vulnerability in Fast FAC1203R Gigabit Edition version 2.0.4. The flaw exists in the copy_msg_element function of the Device Discovery Service component and can be exploited remotely without authentication. Exploit code has been published, but no vendor response or patch is currently available.

This vulnerability involves a stack-based buffer overflow in the copy_msg_element function of the Device Discovery Service in Fast FAC1203R Gigabit Edition 2.0.4. An attacker can remotely manipulate inputs to trigger the overflow, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 base score of 10.0, indicating critical severity. The vendor was contacted but did not respond, and no patch or mitigation guidance has been provided. Exploit code is publicly available.

Detailed information about CVE-2026-96257: Stack-based Buffer Overflow in Fast FAC1203R Gigabit Edition affecting Fast FAC1203R Gigabit Edition. Get real-time u

CVE-2026-96257: Stack-based Buffer Overflow in Fast FAC1203R Gigabit Edition - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-96257: Stack-based Buffer Overflow in Fast FAC1203R Gigabit Edition

Manalyze

CVE-2026-95958 is an integer underflow vulnerability in JusticeRage Manalyze version 1.0.0. The flaw exists in the PE::_parse_relocations function within the PE Parser component, where manipulation of the BlockSize argument can trigger the underflow. Exploitation requires local access. A patch identified by commit c372b6bbca9d8c63812be50596fefa4a79c65fd0 is recommended to remediate this issue.

JusticeRage Manalyze 1.0.0 contains an integer underflow vulnerability in the PE::_parse_relocations function of the manape/pe.cpp file. The vulnerability arises when the BlockSize argument is manipulated, causing an integer underflow condition. This flaw requires local access to exploit and affects the PE Parser component. A patch has been created to address this vulnerability.

Detailed information about CVE-2026-95958: Integer Underflow in JusticeRage Manalyze affecting JusticeRage Manalyze. Get real-time updates, technical details, a

CVE-2026-95958: Integer Underflow in JusticeRage Manalyze - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-95958: Integer Underflow in JusticeRage Manalyze

Smart-Attendance-System-with-QR-Code-Scanner

CVE-2026-95957 is a cross-site scripting (XSS) vulnerability in SourceCodester Smart Attendance System with QR Code Scanner version 1.0. The flaw exists in the prepend function of the student_signup.php file within the Self-Registration component. An attacker can manipulate the full_name argument to inject malicious scripts. Remote exploitation is possible, and a public exploit is available. The vulnerability has a medium severity rating with a CVSS score of 5.3.

This vulnerability affects SourceCodester Smart Attendance System with QR Code Scanner 1.0. It arises from improper sanitization in the prepend function of student_signup.php, specifically in handling the full_name parameter during self-registration. This allows an attacker to perform cross-site scripting attacks by injecting malicious code. The vulnerability is remotely exploitable, and public exploit code exists.

Detailed information about CVE-2026-95957: Cross Site Scripting in SourceCodester Smart Attendance System with QR Code Scanner affecting SourceCodester Smart At

CVE-2026-95957: Cross Site Scripting in SourceCodester Smart Attendance System with QR Code Scanner - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-95957: Cross Site Scripting in SourceCodester Smart Attendance System with QR Code Scanner

This entry is a daily update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Wednesday, September 23rd, 2026.' It provides general security news and information but does not describe any specific security threat or vulnerability.

The provided content is a security news update from the SANS ISC, referencing a podcast episode and general information about the ISC services. There are no technical details, vulnerabilities, exploits, or threat indicators included in the data.

SANS ISC Handlers Diary

Detailed information about ISC Stormcast For Wednesday, September 23rd, 2026 https://isc.sans.edu/podcastdetail/10106, (Wed, Sep 23rd). Get real-time updates, t

ISC Stormcast For Wednesday, September 23rd, 2026 https://isc.sans.edu/podcastdetail/10106, (Wed, Sep 23rd) - Live Threat Intelligence - Threat Radar | OffSeq.com

Original Source

ISC Stormcast For Wednesday, September 23rd, 2026 https://isc.sans.edu/podcastdetail/10106, (Wed, Sep 23rd)

A privilege escalation vulnerability was found in CUPS when used with the cups-filters serial backend. A local user who is a member of the lpadmin group can configure a printer that uses a privileged serial backend. The CUPS scheduler does not restrict the path component of non-file device URIs, so the root-privileged backend can write attacker-controlled print data to an arbitrary file. This can be used to change security-sensitive CUPS configuration and ultimately achieve root code execution. Exploitation requires local lpadmin group membership and a serial backend binary installed with root-only permissions.

This vulnerability arises because the CUPS scheduler does not restrict the path component of non-file device URIs when using the cups-filters serial backend. A local user with lpadmin group privileges can configure a printer using this privileged serial backend, allowing the root-privileged backend to write attacker-controlled print data to arbitrary files. This can modify security-sensitive CUPS configuration files and ultimately lead to root code execution. The vulnerability requires local access with lpadmin rights and the serial backend installed with root-only permissions. SELinux enforcing mode provides partial mitigation. The vulnerability affects Red Hat Enterprise Linux 8, 9, and 10, and Fedora, which ship cups-filters with the serial backend. Products shipping CUPS without this backend are not affected by this specific issue.

Detailed information about CVE-2026-95511: Improper Privilege Management in Red Hat Red Hat Enterprise Linux 10 affecting Red Hat Red Hat Enterprise Linux 10. G

CVE-2026-95511 has been rejected

Official rejection reason