https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T00:28:26.446818+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/certfr-2026-avi-1022 certfr-2026-avi-1022 — De multiples vulnérabilités ont été découvertes dans les produits Netgate. Certaines d'entre elles permettent à un atta… 2026-09-29T00:28:26.485715+00:00 certfr-2026-avi-1022 https://vulnerability.circl.lu/vuln/fkie_cve-2026-56128 fkie_cve-2026-56128 2026-09-29T00:28:26.485808+00:00

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.

 https://vulnerability.circl.lu/vuln/ghsa-xqh2-9r6g-5jrx GHSA-xqh2-9r6g-5jrx 2026-09-29T00:28:26.485882+00:00

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.