123084 matches found
CVE-2026-59328: Improper Neutralization of Input During Web Page Generation
Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...
Linux Distros Unpatched Vulnerability : CVE-2026-17761
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary script...
CVE-2025-69934
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /deletemembers.php?id=1...
PT-2026-66434
Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3150 affected versions not specified Description A privilege escalation issue exists in the init-script for user-applications. This flaw allows a low-privileged local user to execute arbitrary commands with root...
Linux Distros Unpatched Vulnerability : CVE-2026-17853
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject...
CVE-2026-17903: Improper Neutralization of Input During Web Page Generation
Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to inject scripts or HTML into a privileged page via malicious network traffic. Chromium security severity: Low...
PT-2026-66423
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...
CVE-2026-67595
VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...
GHSA-FM7P-GW32-828P mathlive's Lack of Escaping of HTML allows for XSS
Summary Despite the 0.104.0 patch escaping attribute-bearing constructs \htmlData, \href, text-content reflection was missed. The \text, \mbox commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS. Detail...
CVE-2026-8791
The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...
Security update for java-17-openjdk
This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...
EUVD-2026-50273
The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...
CVE-2026-14234 WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in...
CVE-2026-14234
The WOLF WordPress plugin (specifically the WordPress Posts Bulk Editor and Manager ) versions prior to 1.1.0 is vulnerable to stored Cross-Site Scripting (XSS) . The root cause is a lack of nonce or capability checks on one of its AJAX actions , which enables an unauthenticated attacker to perfo...
CVE-2026-14234
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in...
CVE-2026-15735
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-17162
The CVE concerns WowStore – Store Builder & Product Blocks for WooCommerce (WordPress). It describes a Stored Cross-Site Scripting vulnerability via the currentPostId Block Attribute, affecting all versions up to and including 4.4.24 due to insufficient input sanitization and output escaping. Exp...
CVE-2026-12939
The CVE-2026-12939 entry describes a Stored Cross-Site Scripting vulnerability in the WordPress Newsletters Lite plugin (versions up to 4.15). The issue stems from the post_thumbnail() function in helpers/shortcode.php, which concatenates the user-controlled $link attribute directly into an href ...
CVE-2025-67408
The Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection due to improper neutralization of special elements in an SQL command. The vulnerability exists in the /save_user.php file specifically via the status parameter. No details regarding specific impact, remediatio...
