122502 matches found
EUVD-2026-90670
Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...
CVE-2026-7175 Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...
CVE-2026-89427
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
EUVD-2026-90572
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CLEANSTART-2026-HK83739 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
Security vulnerability affects the cri-tools package. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block...
CVE-2026-78210
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization...
CVE-2026-78210
In affected versions of Octopus Server , users with specific scoped permission sets can execute arbitrary scripts in an environment without possessing the required authorization. The vulnerability allows for unauthorized script execution, posing a risk to the integrity of the system. No specific ...
EUVD-2026-90474
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization...
CVE-2026-78210
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization...
MAL-2026-17437 Malicious code in @bluewin/utils (npm)
@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...
Malicious code in @bluewin/utils (npm)
@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...
CLEANSTART-2026-CS99408 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...
EUVD-2026-90431
Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting XSS. This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43...
CVE-2026-78210: Incorrect Authorization
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization...
PT-2026-103671
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization...
Rocky Linux 9 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2022_8096)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228096 advisory. redis: Code injection via Lua script execution environment CVE-2022-24735 redis: Malformed Lua script can crash Redis CVE-2022-24736 Tenable has extracted...
Rocky Linux 8 [CIQ] Security Update: redis / redis-debuginfo / redis-debugsource / redis-devel / etc Multiple Vulnerabilities (crlsa-2022_7541)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20227541 advisory. redis: Code injection via Lua script execution environment CVE-2022-24735 redis: Malformed Lua script can crash Redis CVE-2022-24736 Tenable has extracted...
Linux Distros Unpatched Vulnerability : CVE-2026-102875
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives...
Rocky Linux 9 [CIQ] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (crlsa-2023_0304)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230304 advisory. libreoffice: Macro URL arbitrary script execution CVE-2022-3140 libreoffice: Execution of Untrusted Macros Due to Improper Certificate Validation...
CVE-2026-103064: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wpmet ElementsKit Elementor addons Lite elementskit-lite allows Stored XSS.This issue affects ElementsKit Elementor addons Lite: from n/a through 4.0.6...