https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 14:58:01 +0000 https://vulnerability.circl.lu/vuln/cve-2026-6841 <p><strong>Affected:</strong> Best Practical Request Tracker</p> <p>Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the &#34;Page&#34; parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser.</p> <p>This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2.</p> <p><strong>Affected:</strong> Best Practical Request Tracker</p> <p>Request Tracker is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the &#34;Page&#34; parameter in GET requests. An attacker can craft a URL that, when opened, results in arbitrary JavaScript execution in the victim’s browser.</p> <p>This vulnerability affects versions from 5.0.4 up to 5.0.9 and from 6.0.0 up to 6.0.2.</p> https://vulnerability.circl.lu/vuln/cve-2026-6841 https://vulnerability.circl.lu/vuln/usn-8506-1 <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: request-tracker5, Ubuntu:Pro:24.04:LTS: request-tracker5, Ubuntu:Pro:26.04:LTS: request-tracker5</p> <p>Aleksander Iwicki discovered that Request Tracker did not properly sanitize the search &#34;Page&#34; URL parameter. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. (CVE-2026-6841)</p> <p>It was discovered that Request Tracker did not properly sanitize user- controlled data written to spreadsheet exports of search results. A remote attacker could possibly use this issue to conduct a spreadsheet (CSV/formula) injection attack, causing spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. (CVE-2026-41073)</p> <p>It was discovered that Request Tracker did not properly validate input incorporated into database queries via the entry_aggregator parameter in JSON search. An authenticated user could possibly use this issue to perform SQL injection attacks and read or modify data in the RT database. (CVE-2026-41075)</p> <p>It was discovered that Request Tracker contained an authentication bypass when configured to authenticate users against an LDAP or Active Directory server. Under certain LDAP server configurations, a remote attacker could possibly use this issue to authenticate as any LDAP-backed RT user without supplying valid credentials. (CVE-2026-41076)</p> <p>It was discovered that Request Tracker served certain uploaded content inline rather than as an attachment. A remote attacker could possibly use this issue to conduct a cross-site scripting attack. (CVE-2026-44229)</p> <p>It was discovered that Request Tracker di…</p> <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: request-tracker5, Ubuntu:Pro:24.04:LTS: request-tracker5, Ubuntu:Pro:26.04:LTS: request-tracker5</p> <p>Aleksander Iwicki discovered that Request Tracker did not properly sanitize the search &#34;Page&#34; URL parameter. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. (CVE-2026-6841)</p> <p>It was discovered that Request Tracker did not properly sanitize user- controlled data written to spreadsheet exports of search results. A remote attacker could possibly use this issue to conduct a spreadsheet (CSV/formula) injection attack, causing spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. (CVE-2026-41073)</p> <p>It was discovered that Request Tracker did not properly validate input incorporated into database queries via the entry_aggregator parameter in JSON search. An authenticated user could possibly use this issue to perform SQL injection attacks and read or modify data in the RT database. (CVE-2026-41075)</p> <p>It was discovered that Request Tracker contained an authentication bypass when configured to authenticate users against an LDAP or Active Directory server. Under certain LDAP server configurations, a remote attacker could possibly use this issue to authenticate as any LDAP-backed RT user without supplying valid credentials. (CVE-2026-41076)</p> <p>It was discovered that Request Tracker served certain uploaded content inline rather than as an attachment. A remote attacker could possibly use this issue to conduct a cross-site scripting attack. (CVE-2026-44229)</p> <p>It was discovered that Request Tracker di…</p> https://vulnerability.circl.lu/vuln/usn-8506-1