CVE-2026-82661: Improper Neutralization of CRLF Sequences

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822...

Linux Distros Unpatched Vulnerability : CVE-2026-82661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message header...

CVE-2026-19410: Time-of-check Time-of-use (TOCTOU) Race Condition

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and...

PT-2026-83719

Name of the Vulnerable Software and Affected Versions Google Cloud Build versions prior to 2026-06-24 Description An incorrect authorization issue exists in the GitHub Trigger Comment Control within Google Cloud Platform. A remote attacker can bypass expected review boundaries by manipulating...

CVE-2026-76585 Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

CVE-2026-76585 Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

CVE-2026-76585

The Customer Reviews for WooCommerce WordPress plugin (versions before 5.118.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape the content of customer reviews received via one of the plugin's endpoints, specifically involving th...

WordPress TranslatePress plugin <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via Approved Comment Body in Translation Editor vulnerability discovered by momopon1415 in WordPress Plugin TranslatePress versions = 3.2.6...

CVE-2026-6176 Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...

WordPress LiteSpeed Cache plugin <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability discovered by Jack Taylor in WordPress Plugin LiteSpeed Cache versions = 7.8.1...

WordPress TranslatePress plugin <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser vulnerability discovered by daroo in WordPress Plugin TranslatePress versions = 3.3.3...

CVE-2026-76053

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-18978

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

EUVD-2026-67404

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-18978 LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-18978

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.8.1 . The root cause is insufficient input sanitization and output escaping in the plugin's media handling (src/media.cls.php). An unauthenticated attacker can craft a...

CVE-2026-18978 LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-76053 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-76053 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

EUVD-2026-67397

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...