CVE-2026-103050: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10...

Open Interface Service Web Module Privilege Escalation

The vulnerability of the Open Interface Service in the web module of the Siemens Siveillance Control video surveillance and security management software is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to enhance their privileges and...

CVE-2026-97298: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in King Addons for Elementor = 51.1.86 versions...

PT-2026-103086

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, leading to a SQL Structured Query Language injection. This...

CVE-2026-62078: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-97236: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in ThemeREX Addons 2.45.0 versions...

VulnCheck KEV: CVE-2024-49766

Werkzeug is a Web Server Gateway Interface web application library. On Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch...

CVE-2026-96819: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in oik = 4.15.4 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-102330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass we...

CVE-2026-103049: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-97262: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Visual Composer Website Builder = 45.16.2 versions...

PT-2026-103026

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

Linux Distros Unpatched Vulnerability : CVE-2026-102310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origi...

PT-2026-103505

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3...

PT-2026-103625

Name of the Vulnerable Software and Affected Versions AJA HELO Plus versions prior to 2.1.7 Description A stored cross-site scripting issue exists that allows unauthenticated attackers with network access to inject malicious JavaScript. This occurs when the eParamID SystemName variable is set wit...

PT-2026-103276

Name of the Vulnerable Software and Affected Versions LiteSpeed Web Server LSWS versions prior to 6.3.7 build 1 Description LiteSpeed Web Server LSWS mishandles internal redirect URL validation in a specific corner case. This issue involves double decoding of the same data, which can lead to...

CVE-2026-93903: Double Decoding of the Same Data

LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752087722)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752087722 advisory. - The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1769515411)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1769515411 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1739387851)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739387851 advisory. - URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue affects...