CVE-2026-19619

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

CVE-2026-19619 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

EUVD-2026-80117

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user's session due to...

CVE-2026-19619

CVE-2026-19619 affects GitLab CE/EE versions 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The vulnerability is a cross-site scripting (XSS) flaw caused by improper sanitization of pasted HTML content in the Content Editor . Under certain conditions, an unauthenticated attacker ...

WordPress Formidable Forms plugin 6.34 - Unauthenticated Stored Content Injection vulnerability

Unauthenticated Stored Content Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Formidable Forms versions 6.34...

CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

CVE-2026-85641

CVE-2026-85641 is an unauthenticated stored content injection vulnerability in the Formidable Forms WordPress plugin, affecting versions before 6.35 (specifically identified in version 6.34). The root cause is that the plugin does not restrict who can set the updated_by parameter, which records t...

WordPress Schema & Structured Data for WP & AMP plugin 1.46-1.65 - Unauthenticated Non-Public Comment Content Disclosure vulnerability

Unauthenticated Non-Public Comment Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.46-1.65...

WordPress Schema & Structured Data for WP & AMP plugin 1.63-1.65 - Contributor+ Non-Public Post Content Disclosure vulnerability

Contributor+ Non-Public Post Content Disclosure vulnerability discovered by Shirshak in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.63-1.65...

CVE-2026-82126

The Schema & Structured Data for WP & AMP WordPress plugin (versions 1.63–1.65 ) contains an improper access control flaw in its AI schema generation feature. The plugin fails to verify that a requesting user is permitted to edit the specific post they target for schema generation, allowing any u...

WordPress Schema & Structured Data for WP & AMP plugin < 1.66 - Unauthenticated Password-Protected Post Content Disclosure vulnerability

Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.66...

EUVD-2026-80189

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password...

CVE-2026-5920

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcodecontent' parameter of the btbbshortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter btbbsavepre that can be circumvented via null byte...

changedetection.io

Detecta cambios en sitios web automáticamente — Monitoriza cambios en páginas web en tiempo real Monitoriza sitios web para detectar actualizaciones — recibe notificaciones por Discord, Email, Slack, Telegram, Webhook y muchos más. Detecta cambios en el contenido de páginas web y recibe alertas a...

EUVD-2026-80070

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forger...

EUVD-2026-80048

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious cod...

strutsy

Strutsy Strutsy - Mass exploitation of Apache Struts CVE-2017-5638 vulnerability. Includes blind and time based code injection techniques which significantly reduces false negatives. Other features include mass URL imports to scan multiple targets in one go. Usage: python strutsy.py urls.txt...

CVE-2026-92184

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forger...

CVE-2025-56379

CVE-2025-56379 — Cross-Site Scripting XSS almacenado en ERPNext 15.67.0 / Frappe 15.72.4 📌 Resumen Existe una vulnerabilidad de Cross‑Site Scripting XSS almacenado en el módulo Blog de ERPNext v15.67.0 / Frappe v15.72.4. Un usuario autenticado que pueda crear o editar publicaciones de blog puede...

Linux Distros Unpatched Vulnerability : CVE-2026-92042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...