GHSA-H2XQ-H7F9-VH6C XWiki Blog Application home page vulnerable to Stored XSS via Post Title

Impact The Blog Application is vulnerable to Stored Cross-Site Scripting XSS via the Blog Post Title. The vulnerability arises because the post title is injected directly into the HTML tag without proper escaping. An attacker with permissions to create or edit blog posts can inject malicious...

EUVD-2025-208293

XWiki Blog Application home page vulnerable to Stored XSS via Post Title...

CVE-2026-27800

creationtimestamp| type| source ---|---|--- 2026-03-04 04:00:16+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mg7fhss2p32a...

CVE-2026-27757

creationtimestamp| type| source ---|---|--- 2026-03-04 01:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mg75nasnqg2m...

CVE-2025-66024: Improper Neutralization of Input During Web Page Generation

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Versions starting with 9.15 and prior to 9.15.7 are vulnerable to Stored Cross-Site Scripting XSS via the Blog Post Title. The vulnerability arises because the post title is injected directly into the...

CVE-2026-1273: Server-Side Request Forgery (SSRF)

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.8 via the /ultp/v3/starterdummypost/ and /ultp/v3/starterimportcontent/ REST API endpoints. This makes it possible...

PT-2026-23065

Name of the Vulnerable Software and Affected Versions XWiki blog application versions prior to 9.15.7 Description The XWiki blog application is subject to Stored Cross-Site Scripting XSS, a condition where malicious scripts are permanently stored on the target server. The issue occurs because the...

XWiki Platform Cross-site Scripting Vulnerabilities

The XWiki Platform is an open-source wiki platform designed for creating web collaboration applications. Versions of the XWiki Platform prior to 9.15.7 contained a cross-site scripting vulnerability. This vulnerability stemmed from insufficient escaping of HTML title tags when injecting blog...

The research never stops: Zhiniang Peng’s security research story

Some security researchers discover hacking early. Others discover it accidentally. For Zhiniang Peng, it started with curiosity and cybersecurity magazines...

coderedcms (>=2.0.0, <=2.1.4), puput (1.2.0) +27 more potentially affected by CVE-2026-28223 via wagtail (4.2.4)

wagtail PYPI version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =2.0.0, =0.1.0, =0.3.4, =0.0.1, =1.6.0, =0.18.0, =0.19.2 - wagtail-hallo 0.3.0 - wagtail-images-deduplicator 1.0.0a1 and more Source...

coderedcms (>=0.18.0, <=0.18.2), coop (>=2.8.0, <=2.8.2) +10 more potentially affected by CVE-2026-28222 via wagtail (2.8.2)

wagtail PYPI version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.18.0, =2.8.0, =0.0.5, =4.1.0, =0.5.0, =1.0.0, =0.22.0, =3.8.0, =3.9.0 Source cves: CVE-2026-28222 Source advisory:...

Choose the Right GPU on Akamai Cloud for Your AI Workload

...

CVE-2026-3025

creationtimestamp| type| source ---|---|--- 2026-03-03 01:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mg4n6d4eed2w...

Claude Code Security set the Cybersecurity Stocks on Fire - Here's the Signal in the Smoke

Learn how Claude Code Security set Cybersecurity stocks on fire...

PT-2026-22809

Name of the Vulnerable Software and Affected Versions FreeScout versions 1.8.206 and earlier Description FreeScout is susceptible to remote code execution RCE vulnerabilities CVE-2026-27636 and CVE-2026-28289. CVE-2026-27636 allows authenticated users with file upload permissions to execute code ...

Post-Quantum Cryptography Beyond TLS: Remain Quantum Safe

...

WordPress Plugin Context Blog Information Disclosure Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin Context Blog. The...

US and Israel Launch Strikes Against Iran

US president Donald Trump said a “major combat operation” against Iran had begun as he called for the country’s government to be overthrown...

Friday Squid Blogging: Squid Fishing in Peru

Peru has increased its squid catch limit. The article says "giant squid," but they can't possibly mean that. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy...

11x-wagtail-blog (>=0.0.0, <=0.2.0), anyvec (0.1.3) +61 more potentially affected by CVE-2026-28231 via pillow-heif (0.22.0)

pillow-heif PYPI version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow-heif and may be impacted: - 11x-wagtail-blog =0.0.0, =3.0.0, =5.2.0, =1.0.0, =2.0.0, =2.30.0, =0.1.0a1, =1.0.0.dev0, =0.4.0a0, =4.0.0, =0.7.0, =0.7.2 and more Source...