WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability

Content Injection vulnerability discovered by kta1kri in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-79621 CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-79621 CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

CVE-2026-79621: Insufficient Verification of Data Authenticity

The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...

tar: tar: Hidden file injection via crafted archives

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files...

MiracleLinux 8 : abrt-2.10.9-26.el8_10.ML.1 (AXSA:2026-1725:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1725:01 advisory. abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories CVE-2026-54228 abrt: ChownProblemDir succeeds...

Alibaba Cloud Linux 3 : 0262: abrt (ALINUX3-SA-2026:0262)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0262 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-54228: A time-of-check time-of-us...

SUSE CVE-2026-54231

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A...

CVE-2026-82271

R2R (SciPhi-AI) versions through 3.6.5 fail to properly validate user ownership in conversation update and message handlers. An authenticated user can supply arbitrary conversation identifiers to rename other users' conversations and append messages to their histories, corrupting state and inject...

CVE-2026-54766: Improper Authorization

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093157)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093157 advisory. GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. Tenable has extracted the preceding description block...

Unity Linux 20.1060a / 20.1070a Security Update: abrt (UTSA-2026-104826)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104826 advisory. A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries...