CVE-2026-97735: Improper Neutralization of Input During Web Page Generation

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

EUVD-2025-211003

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

PT-2026-98826

Name of the Vulnerable Software and Affected Versions D-Link DAP-2610 versions prior to 2.06B08r099 Description An authenticated command injection issue exists within the web interface at the '/index.xgi' endpoint. An attacker with authenticated access can exploit specific parameters to execute...

PT-2026-98397

Name of the Vulnerable Software and Affected Versions Repeater Fields for Elementor Forms versions prior to 2.2.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into...

CVE-2026-14281: Improper Privilege Management

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route POST...

PT-2026-99124

Name of the Vulnerable Software and Affected Versions Mediawiki - Wikibase Extension versions prior to 1.46.1 Mediawiki - Wikibase Extension version 1.45.5 Mediawiki - Wikibase Extension version 1.43.10 Description Improper neutralization of input during web page generation allows for Cross-Site...

CVE-2026-84463: Improper Neutralization of Input During Web Page Generation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

golang-x-net Package Code Execution

The vulnerability of the golang-x-net package in the Golang programming language is related to the lack of protective measures for web page structures. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Asynchronous Python-daphne Unlimited Resource Distribution DoS

The vulnerability of the asynchronous Python-daphne web server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2026-96876: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

PT-2026-98909

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description The Web STOMP WebSocket handler fails to enforce max frame size and log...

CVE-2025-51457: Improper Neutralization of Special Elements used in a Command

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

Security update for MozillaFirefox (important)

openSUSE security update: security update for mozillafirefox ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21951-1 Rating: important References: bsc1280371 Cross-References: CVE-2026-92005 CVE-2026-92006 CVE-2026-92007 CVE-2026-92008 CVE-2026-9200...

Linux Distros Unpatched Vulnerability : CVE-2026-67230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesiz...

WordPress Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin <= 4.8.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Jiemook in WordPress Plugin Wawp versions = 4.8.6...

CVE-2026-48543

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

CVE-2026-48543 Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

EUVD-2026-86448

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

CVE-2026-48543

Krayin CRM versions through 2.2.6 are vulnerable to a stored client-side template injection leading to Cross-Site Scripting (XSS) . The vulnerability exists in the web form description field , where an authenticated attacker can inject Vue.js template expressions using double-brace syntax. When p...

CVE-2026-48543 Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...