1047330 matches found
CVE-2026-19697 GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...
EUVD-2026-63203
The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...
CVE-2026-19615
The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 fails to sanitize SVG uploads on all accepted routes (including XML-RPC), allowing users with upload privileges to store JavaScript that executes in any visitor's browser as stored XSS. CISA SSVC reports no active exploitation. R...
EUVD-2026-63204
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including...
CVE-2026-19697
The GutenKit WordPress plugin (before 2.5.0) fails to sanitise SVG files on all enabled upload paths, allowing users with the file-upload capability (e.g. Author role) to upload a malicious SVG and execute Stored XSS against any viewer, including administrators. CVSS 3.1 scores 6.8 (MEDIUM). Upgr...
CVE-2026-76331
creationtimestamp| type| source ---|---|--- 2026-08-20 04:46:25+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...
CVE-2026-76263
creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:31+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...
X-Recon
أداة لتحديد مدخلات صفحات الويب وإجراء فحص XSS. الميزات: اكتشاف النطاقات الفرعية: يقوم باسترداد النطاقات الفرعية ذات الصلة بالموقع المستهدف ودمجها في قائمة بيضاء. يمكن استخدام هذه النطاقات الفرعية أثناء عملية التجريف. اكتشاف الروابط على مستوى الموقع: يجمع جميع الروابط عبر الموقع بناءً على القائمة...
GHSA-22G5-R2X5-97CX vulnerabilities
Vulnerabilities for packages: opensearch-dashboards, wazuh-dashboard, wazuh-dashboard-fips, opensearch-dashboards-fips...
CVE-2026-44979 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards...
GHSA-22G5-R2X5-97CX vulnerabilities
Vulnerabilities for packages: opensearch-dashboards...
CVE-2026-59711 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards...
CVE-2026-48049 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards...
CVE-2026-54089 vulnerabilities
Vulnerabilities for packages: filebrowser...
EUVD-2026-62932
In Splunk SOAR versions below 8.6.0, a user who holds the "Incident Commander" Splunk SOAR role could store JavaScript in a note and run it in the browser of another user when that user opens the note. The stored Cross-Site Scripting XSS vulnerability is possible because Splunk SOAR can treat...
EUVD-2026-62911
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious script in dashboard sparkline format options and execute unauthorized JavaScript in the browser of another user who views the dashboard. If the other user holds...
EUVD-2026-62898
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator URL. When another authenticated user selects the stored action from Event Actions and selects...
EUVD-2026-63125
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could store a malicious script in an alert trigger condition field. When another user opens the crafted link, the script runs in the browser of that user and could...
EUVD-2026-63131
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and cause arbitrary JavaScript to run in the browser of another user when that user opens a crafted tour link. The JavaScript runs in the brows...
EUVD-2026-63132
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser o...