CVE-2026-65560

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-65560 WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-65560

The vulnerability CVE-2026-65560 is an Unauthenticated XSS in the WordPress Houzez Property Feed plugin, affected versions

EUVD-2026-53985

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-65560 WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-64584

creationtimestamp| type| source ---|---|--- 2026-08-06 12:15:14+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-64584 2026-08-12 20:46:06+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806...

WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Houzez Property Feed versions = 2.5.48...

PT-2026-68556

Name of the Vulnerable Software and Affected Versions Houzez Property Feed versions prior to 2.5.49 Description The Houzez Property Feed plugin for WordPress contains a stored Cross-Site Scripting XSS flaw. This issue occurs because the software fails to properly sanitize input and escape output,...

CVE-2026-66709: Improper Control of Generation of Code

Shop manager Remote Code Execution RCE in CTX Feed = 6.6.42 versions...

CVE-2026-65560: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

PT-2026-68602

Name of the Vulnerable Software and Affected Versions CTX Feed versions prior to 6.6.43 Description Shop manager Remote Code Execution RCE allows an attacker to execute arbitrary code on the server. Recommendations Update CTX Feed to version 6.6.43 or later...

rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

Summary A valid but nondefault FTP filename encoding can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the line-oriented FTP control channel. The dependency does not reject CR or LF in command arguments, so a filename can inject an independent...

CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71311

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

EUVD-2026-53618

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

CVE-2026-71311

rclone (pre-1.75.0) is affected by a CRLF injection in FTP filename handling: a valid but nondefault encoding in backend/ftp/ftp.go can restore raw CR/LF before an attacker-controlled path is interpolated into the FTP control channel. github.com/jlaffaye/ftp formats the argument via textproto.Con...

Malicious code in akamai-sensorv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5e3bd6235ef87b1f7df5dae95ccbf9868ab3f861ff4fdf0396e20dc6ec4ffb akamai-sensorv2 hides an executable payload inside a source comment in index.js composed entirely of invisible Unicode variation selectors FE00-FE0F...

Malicious code in akamai-sensorv1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc0d67815042459dd2e8c526215eb8e204e0b62ae97438b320c0bd0a69a2ddf The package hides an executable payload inside a block comment in index.js using Unicode variation selectors U+FE00–U+FE0F and U+E0100–U+E01EF...