EUVD-2026-85055

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products...

CVE-2026-20285

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

CVE-2026-20286

A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-20286 Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-63325

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

PT-2026-93972

A vulnerability in the web-based management interface of Cisco Identify Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS in legacy PHP template pages that render unescaped SNMP-sourced data fields, including BGP...

Important: Red Hat Security Advisory: Cluster Observability Operator 1.5.2

The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.5.2 release of COO...

CubeCart 6.7.4 - Stored XSS

Exploit Title: CubeCart 6.7.4 - Stored Cross-Site Scripting Date: 2026-06-08 Exploit Author: Mikail Kocadağ MKLKCDG Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE: CVE-2026-54645 Advisory / References:...

CVE-2026-54624

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, renderobjectstructure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling usercanviewpage. Any staff account can request a restricted...

AZL-96093 CVE-2026-74566 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: keys: make keyring key-chunk byte order agree with keyringdiffobjects keyringgetkeychunk loads description bytes into the index chunk low address first, while keyringdiffobjects numbers the first differing bit from the low end an...

mkdocs-meta-descriptions-plugin (>=0.0.3, <=0.0.4) potentially affected by CVE-2026-67422 via pymdown-extensions (8.1.1)

pymdown-extensions PYPI version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-meta-descriptions-plugin =0.0.3, =0.0.4 Source cves: CVE-2026-67422 Source advisory: OSV:PYSEC-2026-3654...

EulerOS 2.0 SP11 : cups (EulerOS-SA-2026-3062)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker ca...

mkdocs-meta-descriptions-plugin (>=0.0.3, <=0.0.4) potentially affected by CVE-2026-67422 via pymdown-extensions (8.1.1)

pymdown-extensions PYPI version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-meta-descriptions-plugin =0.0.3, =0.0.4 Source cves: CVE-2026-67422 Source advisory: OSV:GHSA-GM37-52C6-37MW...

CVE-2026-48078 OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...

EulerOS 2.0 SP13 : cups (EulerOS-SA-2026-2961)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker ca...

EulerOS 2.0 SP13 : cups (EulerOS-SA-2026-3011)

According to the versions of the cups packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker ca...

mkdocs-meta-descriptions-plugin (>=0.0.3, <=0.0.4) potentially affected by CVE-2026-61632 via pymdown-extensions (8.1.1)

pymdown-extensions PYPI version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - mkdocs-meta-descriptions-plugin =0.0.3, =0.0.4 Source cves: CVE-2026-61632 Source advisory: OSV:PYSEC-2026-3609...

CVE-2026-49131

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized...

CVE-2026-49132 OPNsense < 26.1.9 Stored XSS via Certificate Description Field

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...