WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. id: CVE-2019-17233 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated HTML Content Injection author: daffainfo severity: medium description: | Functions/EWDUFAQImport.ph...

CVE-2026-76613

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

CVE-2026-76613

YOOtheme Pro (a Joomla extension by yootheme.com) versions 1.0.0 through 5.0.40 are affected by an authenticated, privileged SQL injection vulnerability. Any user with contributor-level access can inject arbitrary content into SQL queries, resulting in high impact on the confidentiality, integrit...

CVE-2026-54625

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-54625 django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)

django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through getvarycacheon. The pagecachekey function includes the cache prefix, site, language, path, and timezone bu...

CVE-2026-42164

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...

SUSE CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

Cross-site Scripting (XSS)

Overview std/html/template is a Go standard library package std/html/template Affected versions of this package are vulnerable to Cross-site Scripting XSS. Go Vulnerability Report:Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject...

abrt security update

An update is available for abrt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Automatic Bug Reporting Tool ABRT recognizes defects in applications and...

PT-2026-71896

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Pathological inputs can cause an unescaped '/' to close prematurely. This allows attack-controlled data to inject arbitrary content, which may lead to Cross-Site...

Important: abrt security update

The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality. Security Fixes: abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump...

CVE-2026-57105

CVE-2026-57105 is a cross-site scripting vulnerability in Microsoft Office SharePoint caused by improper neutralization of input during web page generation. An authorized attacker could perform network spoofing. The CVSSv3.1 base score is 8.0 ( HIGH ) with Network attack vector, low attack comple...

EUVD-2026-55667

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1...

CVE-2026-72728 Discourse: Onebox iframe origin allowlist enforces URL authority boundary

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1...

CVE-2026-72587

A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /instatic/hole/ server island endpoint...