7049 matches found
CVE-2026-87915
The Popup Maker WordPress plugin is vulnerable to unauthenticated stored cross-site scripting (XSS) via the values[Name] parameter in all versions up to and including 1.24.0 . The root cause is insufficient input sanitization and output escaping : although wp_kses is applied on output, HTML entit...
Malicious Package
Overview link-uglify-js-fermiparadox-auth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...
CVE-2026-87915: Improper Neutralization of Input During Web Page Generation
The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via valuesName Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. Th...
CVE-2026-93749: Improper Validation of Specified Quantity in Input
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...
PT-2026-95589
Name of the Vulnerable Software and Affected Versions source-map-js versions 1.2.1 and earlier Description The software fails to validate the per-section offset line value in indexed source maps. An attacker can provide arbitrary and extremely large numeric values for these offsets, which leads t...
PT-2026-102285
TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 4.3.0-tuxcare.1...
CVE-2026-93690: Loop with Unreachable Exit Condition
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...
PT-2026-99965
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions wit...
PT-2026-95343
Name of the Vulnerable Software and Affected Versions Popup Maker versions prior to 1.24.1 Description The plugin is subject to Stored Cross-Site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server. Unauthenticated attackers can inject arbitrary web scripts...
PT-2026-95434
Name of the Vulnerable Software and Affected Versions uri-js versions prior to 4.4.2 Description A denial of service issue exists in the removeDotSegments function. The function enters an infinite loop when a path segment starts with Unicode line or paragraph separators. This can be triggered by...
CVE-2026-93751: Improper Handling of Unicode Encoding
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...
PT-2026-95591
Name of the Vulnerable Software and Affected Versions uri-js versions 4.4.1 and earlier Description An improper UTF-8 decoding issue exists in the pctDecChars function. This flaw allows the decoding of invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can use...
CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...
CVE-2026-54645 CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...
CVE-2026-86038
creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:04+00:00| published-proof-of-concept| https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp...
Important: Red Hat Security Advisory: Kiali 2.17.14 for Red Hat OpenShift Service Mesh 3.2
Kiali 2.17.14 for Red Hat OpenShift Service Mesh 3.2 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Important: Red Hat Security Advisory: Kiali 2.11.17 for Red Hat OpenShift Service Mesh 3.1
Kiali 2.11.17 for Red Hat OpenShift Service Mesh 3.1 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Important: Red Hat Security Advisory: Kiali 2.4.23 for Red Hat OpenShift Service Mesh 3.0
Kiali 2.4.23 for Red Hat OpenShift Service Mesh 3.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
CVE-2026-92418 ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting
A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoint. This manipulation of the argument customerName causes...
