CVE-2026-68919

GoCD (a continuous delivery server) is affected by a stored cross-site scripting (XSS) vulnerability (CVSS 4.0: 7.0 HIGH ) in versions 13.3.0 through 26.1.0. The root cause is improper encoding and escaping of material modification comments that mimic the trackback format used by package material...

CVE-2026-16651

The temporalio/sqlparser library, used by Temporal Server , can panic when parsing a MySQL version comment that is empty or contains only one to five decimal digits. The root cause is in ExtractMysqlComment , which does not handle the -1 return value from strings.IndexFunc before using it as a sl...

WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability discovered by Pham Duc Anh in WordPress Plugin Asset CleanUp: Page Speed Booster versions = 1.4.0.5...

PT-2026-96072

Name of the Vulnerable Software and Affected Versions temporalio/sqlparser affected versions not specified Temporal Server affected versions not specified Description A panic occurs when the Parse, ParseStrictDDL, or ParseNext functions process a MySQL version comment that is empty or contains on...

CVE-2026-16651: Improper Validation of Array Index

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The...

CVE-2026-87839

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

WordPress Tripzzy plugin < 1.5.1 - Unauthenticated Arbitrary Comment Deletion vulnerability

Unauthenticated Arbitrary Comment Deletion vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Tripzzy Travel Engine System versions 1.5.1...

CVE-2026-87839 Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-87839

The Tripzzy WordPress plugin (versions before 1.5.1 ) contains an improper access control vulnerability. The root cause is a lack of authorization checks and failure to validate the identifier of the object being removed within an AJAX action . Because this action is accessible to unauthenticated...

EUVD-2026-83672

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-87839 Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-87839: Improper Access Control

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

PT-2026-95925

Name of the Vulnerable Software and Affected Versions Tripzzy versions prior to 1.5.1 Description An AJAX action available to unauthenticated users lacks authorization checks and fails to validate the identifier of the object being removed. This allows an attacker to permanently delete arbitrary...

CVE-2026-13354

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-13354

The Asset CleanUp: Page Speed Booster WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via Comment Content in all versions up to and including 1.4.0.5 . The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrar...

EUVD-2026-83469

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-13354 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-13354 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-95735

Name of the Vulnerable Software and Affected Versions Asset CleanUp: Page Speed Booster versions prior to 1.4.0.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment content. This enables the...

CVE-2026-13354: Improper Neutralization of Input During Web Page Generation

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...