PT-2026-76743

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

EUVD-2026-60355

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

PT-2026-73257

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-63669: Authorization Bypass Through User-Controlled Key

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move operation fails to enforce the destination parent's create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or...

Joomla JCE_2.9.15 - Remote Code Execution

Exploit Title: Joomla JCE2.9.15 - Remote Code Execution Date: 2026-07-10 Exploit Author: K3ysTr0K3R Jared Brits Vendor Homepage: https://www.joomla.org/ Software Link: https://extensions.joomla.org/extension/jce/ Version: JCE 1.0.0 through 2.9.99.4 fixed in 2.9.99.5 Tested on: Joomla 3.10.11 / JC...

PT-2026-76893

Name of the Vulnerable Software and Affected Versions uniget CLI affected versions not specified Description The uniget CLI contains a command injection flaw during hook editing. The application retrieves the editor path from the UNIGET EDITOR or EDITOR environment variables and uses the...

CVE-2026-17604 Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-17604 Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-17604

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-15002 Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...

EUVD-2026-59856

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-12477 Gravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-12477

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

[SECURITY] Fedora 44 Update: rust-git-interactive-rebase-tool-2.4.1-17.fc44

Full-featured terminal-based sequence editor for Git interactive rebase...

PT-2026-73137

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the ' gallery order post id' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

CVE-2026-12477: Improper Neutralization of Input During Web Page Generation

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-2497: Improper Neutralization of Special Elements used in an SQL Command

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-17604: Improper Limitation of a Pathname to a Restricted Directory

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

PT-2026-73087

Name of the Vulnerable Software and Affected Versions Platnosci Online Blue Media Autopay plugin for WordPress versions prior to 5.0.1 Description Stored Cross-Site Scripting occurs via the bm woocommerce css editor content POST parameter. The Css Editor::handle save function is linked to the...