CVE-2026-68567 WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

CVE-2026-68567

The WordPress Convert Pro plugin (versions ≤ 1.0.1) contains an unauthenticated reflected/stored XSS flaw exploitable via network access with low complexity; CVSS 7.1 (High). Patchstack reports it. Upgrade to a patched version if available; no exploitation evidence provided. See https://patchstac...

EUVD-2026-60935

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

CVE-2026-68567 WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

CVE-2026-68567

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Convert Pro versions = 1.0.1...

CVE-2026-68567: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

PT-2026-77078

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: zarf, pdfcpu, metrics-agent, hubble-ui, rancher-system-agent, step, docker-credential-ecr-login, certificate-transparency, rekor, sealed-secrets, osv-scanner, juicefs-csi-driver, rancher, knative-eventing, docker-credential-acr-env, gitness, crossplane, descheduler,...

Libvirt: information disclosure via world-readable storage volume images during clone/convert

...

AZL-95613 CVE-2026-63623 affecting package libvirt for versions less than 11.9.0-1

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

CVE-2026-63623 Libvirt: information disclosure via world-readable storage volume images during clone/convert

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

CVE-2026-63623 Libvirt: information disclosure via world-readable storage volume images during clone/convert

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

CVE-2026-71270

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...

CVE-2026-71270

Stirling-PDF CVE-2026-71270 affects the POST /api/v1/convert/url/pdf endpoint. Unlike its siblings (html/pdf, file/pdf, markdown/pdf), this endpoint was not updated with CustomHtmlSanitizer/SsrfProtectionService SSRF protections. It only validates that the initial URL resolves to a public IP, the...

PT-2026-68143

Name of the Vulnerable Software and Affected Versions Stirling-PDF affected versions not specified Description The POST /api/v1/convert/url/pdf endpoint in ConvertWebsiteToPDF.java lacks Server-Side Request Forgery SSRF protections. While the endpoint verifies that the initial URL resolves to a...

CVE-2026-71270: Server-Side Request Forgery (SSRF)

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...

CVE-2026-70374: Improper Neutralization of Special Elements used in an OS Command

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...

PT-2026-69032

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 12.6.0-1.1 Description A flaw exists during storage volume clone or convert operations where newly created volume images are temporarily world-readable. This occurs because the qemu-img utility operates with overly...

PT-2026-76197

GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convert fname function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is...