PT-2026-80218

Impact Any user who can edit a page in XWiki can use Live Data's edit REST API in XWiki to change the rights on that page. This allows the user to obtain script right on the page. Script right allows the user to execute potentially dangerous Velocity scripts and send unfiltered HTML and JavaScrip...

CVE-2026-52792: Improper Handling of Windows ::DATA Alternate Data Stream

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-72529: Missing Authentication for Critical Function

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...

CVE-2026-56088: Improper Neutralization of Special Elements used in an SQL Command

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...

CVE-2026-14334: Improper Neutralization of Input During Web Page Generation

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

CVE-2026-70422: Improper Neutralization of Special Elements used in an SQL Command

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...

PT-2026-78309

Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can embed a...

CVE-2026-15446: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

ROS-20260819-73-0049

The vulnerability in Tomcat11 relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

ROS-20260819-73-0048

The vulnerability in Tomcat10 relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-23938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to...

PT-2026-78268

Name of the Vulnerable Software and Affected Versions acmailer affected versions not specified Description A cross-site scripting XSS issue exists, which may allow an attacker to execute an arbitrary script. Cross-site scripting is a type of security flaw where malicious scripts are injected into...

PT-2026-78377

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection, exists in the software. A low privileged attacker with remote access could...

PT-2026-78703

Name of the Vulnerable Software and Affected Versions acm-operator-bundle affected versions not specified Description The build process for this component downloads and executes a script from a remote source without verifying its authenticity or integrity. This allows a remote attacker to inject...

CVE-2026-66358: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script...

PT-2026-78360

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection, allows a low privileged attacker with remote access to potentially execute...

Malicious code in raectjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75a611c33224c779330b8d5313702dc44f20d197dd96f62fb236982281b9d09 scripts/postinstall.js runs on npm install and performs two attacker-beneficial actions. First, it POSTs a JSON platform snapshot to the hardcoded...

Malicious code in lodsh-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2803016f5b10510cdb31304197a1670396290e9be96fe647fd6c505d1f487273 lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it...

Malicious code in comand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3576e830f201f4264c061dc377c51fa35bab19543a98c0feb316305051190b On npm install, scripts/postinstall.js executes automatically. It first POSTs a JSON body containing the resolved host platform Windows/MacOS/Linux,...

Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...