PT-2026-78753

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can store a dashboard...

PT-2026-78760

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description Dashboard Studio fails to sufficiently validate...

PT-2026-78335

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

PT-2026-78482

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.2 Description The plugin fails to invoke the Security::sanitizeSVG function within the HandlesMediaUploads::processUploadedFile function when processing the 'POST /api/v1/media' endpoint. While the SVG...

PT-2026-78652

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.90 Description An issue exists where the isFileValid function in models/fileValidation.js relies on the Unix file command for content-based MIME detection. When the file binary is unavailable, the detectMimeFromFile...

PT-2026-78752

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A Cross-Site Scripting XSS issue exists where a user with t...

UBUNTU-CVE-2026-75838

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability...

PT-2026-78386

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description The software writes content backup ZIP archives to the web-accessible document root at the endpoint 'content.zip', which exposes sensitive files such as database credentials. Unauthenticated attacke...

SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:3640-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3640-1 advisory. Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. -...

PT-2026-78309

Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can embed a...

PT-2026-78489

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

PT-2026-78773

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the "power" role can store a malicious script...

PT-2026-78375

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An Improper Neutralization of Input During Web Page Generation, known as Cross-site Scripting XSS, allows a low privileged attacker with remote access to potentially cause...

PT-2026-78454

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...

ROS-20260819-73-0049

The vulnerability in Tomcat11 relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

ROS-20260819-73-0047

The vulnerability in Tomcat relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2026-66591

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

CVE-2026-27365

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...

CVE-2026-27365 WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...

CVE-2026-27365

The WordPress PublishPress Series plugin (versions through 2.17.0) has a stored XSS flaw from improper input neutralization during page generation. Patchstack rates it MEDIUM (CVSS 5.9) requiring high privileges and user interaction. No exploitation data is provided. Upgrade to a patched version ...