Nextcloud: PIN bypass in PassCodeActivity via back button

A vulnerability was discovered in the PassCodeActivity of a certain application. The vulnerability allowed bypassing the PIN code by pressing the back button...

WordPress WP Random Button plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'cat' Shortcode Attribute vulnerability discovered by zakaria in WordPress Plugin WP Random Button versions = 1.0...

CVE-2019-25606

Fast AVI MPEG Joiner 1.2.0812 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload in the License Name field. Attackers can create a malicious text file containing 6000 bytes of data and paste it into the License Name inpu...

CVE-2019-25606

Vulnerability summary: CVE-2019-25606 affects Fast AVI MPEG Joiner 1.2.0812. The issue is a buffer overflow in the License Name input that can be triggered by an oversized payload, enabling a local attacker to cause a denial of service by pasting a ~6000-byte text file into the License Name field...

EUVD-2019-19872

jetAudio 8.1.7 contains a buffer overflow vulnerability in the video converter component that allows local attackers to crash the application by supplying an oversized string in the File Naming field. Attackers can paste a malicious buffer of 512 bytes into the File Naming parameter and trigger t...

CVE-2019-25562

JetAudio 8.1.7 is affected by a local-denial-of-service via a buffer overflow in the video converter’s File Naming field. A 512-byte malicious buffer pasted into File Naming and triggered by clicking Preview crashes the application. Root cause: buffer overflow in the File Naming parameter. Affect...

EUVD-2026-14010

The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wprandombutton' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on...

CVE-2026-4086

The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wprandombutton' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on...

CVE-2026-4086

The CVE concerns the WP Random Button WordPress plugin (versions up to 1.0). It is vulnerable to Stored Cross-Site Scripting via the wp_random_button shortcode attributes cat, nocat, and text. The root cause is insufficient input sanitization and output escaping: the random_button_html() function...

CVE-2026-4086 WP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute

The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wprandombutton' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on...

PT-2026-26875

The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp random button' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on...

PT-2026-26907

jetAudio 8.1.7 contains a buffer overflow vulnerability in the video converter component that allows local attackers to crash the application by supplying an oversized string in the File Naming field. Attackers can paste a malicious buffer of 512 bytes into the File Naming parameter and trigger t...

CVE-2026-33209

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to version 3.30.3, a reflected cross-site scripting XSS vulnerability exists in the returnto query parameter used in the avo interface. An attacker can craft a malicious URL that injects arbitrary JavaScript, which is execute...

EUVD-2026-13072

The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the...

CVE-2026-4120

The Info Cards – Add Text and Media in Card Layouts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnUrl' parameter within the Info Cards block in all versions up to, and including, 2.0.7. This is due to insufficient input validation on URL schemes, specifically the...

MAL-2026-1818 Malicious code in player-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ef576512d757081a6ffcf3225a09220078dde23b0825b516ee210f6bf1b0c94 The package player-button was found to contain malicious code...

Malicious code in player-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ef576512d757081a6ffcf3225a09220078dde23b0825b516ee210f6bf1b0c94 The package player-button was found to contain malicious code...

Malicious code in @kui-react/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb2774da41feb2f5825c18cb59ff37b64a456fd5770d202cc5542aaaa634f4df The package @kui-react/button was found to contain malicious code...

MAL-2026-1625 Malicious code in @kui-react/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb2774da41feb2f5825c18cb59ff37b64a456fd5770d202cc5542aaaa634f4df The package @kui-react/button was found to contain malicious code...

Malicious code in @emerald-react/icon-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a17ff250c076101691329fe30e2efab7630e3563d3c0e6423a94d0eeec60d3dc The package @emerald-react/icon-button was found to contain malicious code...