Hamayanhamayan

**Name of the Vulnerable Software and Affected Versions** GitHub Enterprise Server versions prior to 3.21 **Description** A stored cross-site scripting issue exists where an authenticated attacker can execute arbitrary JavaScript in another user's browser. This occurs by injecting a crafted payload into the title of a Discussion within the Q&A category. The `AnsweredQuestionStructuredDataComponent` fails to escape user-controlled Discussion titles before embedding them in a `<script type="application/ld+json">` block, enabling the title to break out of the script context. The attack is further escalated by leveraging JSONP (JSON with Padding, a technique to allow cross-domain data requests) callback support in the REST API to bypass the Content Security Policy. **Recommendations** Update to version 3.20.4 Update to version 3.19.8 Update to version 3.18.11 Update to version 3.17.17

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** When using the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory, leading to a crash. This occurs specifically when utilizing the `LookupCNAME()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 26.4 iOS versions prior to 18.7.7 iPadOS versions prior to 18.7.7 macOS Tahoe versions prior to 26.4 **Description** A logic issue exists that, if exploited via a maliciously crafted website, may lead to a cross-site scripting attack. The issue was addressed with improved checks. **Recommendations** Update Safari to version 26.4. Update iOS to version 18.7.7. Update iPadOS to version 18.7.7. Update macOS Tahoe to version 26.4.