CVE-2026-59553

CVE-2026-59553 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress Product Feed Manager plugin, affecting versions ≤ 7.6.1. The Connected documents confirm the affected software (WordPress Product Feed Manager plugin) and the vulnerability class (XSS) with the s...

CVE-2026-12990 Multiple vulnerabilities in Ghost Robotics' Vision 60

An access control vulnerability in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active,...

WordPress Product Feed Manager plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Product Feed Manager versions = 7.6.1...

VulnCheck KEV: CVE-2026-59553

Unauthenticated Cross Site Scripting XSS in Product Feed Manager = 7.6.1 versions...

PT-2026-64153

Name of the Vulnerable Software and Affected Versions swift-nio-http2 versions prior to 1.45.0 Description SwiftNIO HTTP/2 lacks validation for inbound HEADERS frames, allowing control characters such as CR, LF, NUL, and SP to reach an HTTP/1.1 backend via the HTTP/2-to-HTTP/1 codec. This can lea...

GO-2026-6036 Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) in gitea.dev

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698 in gitea.dev...

GO-2026-6031 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea...

Plone 4.3.x < 5.2.5 Multiple Vulnerabilities (HF 20210518)

The version of Plone installed on the remote host is 4.3.x prior to 5.2.5. It is, therefore, affected by the following vulnerabilities: - Plone CMS has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. CVE-2021-3313 -...

PT-2026-63552

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description Netty's HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into...

The vulnerability affects the classes HAProxyMessage and HAProxyMessageEncoder of the Netty framework, which is used for developing network applications, servers, and client protocols. This vulnerability allows an attacker to replace the original data with malicious content.

The vulnerability of the HAProxyMessage and HAProxyMessageEncoder classes in the Netty framework for developing network applications, servers, and clients is related to the failure to handle CRLF sequences properly. Exploiting this vulnerability can allow an attacker to replace legitimate data wi...

GHSA-H56G-4QW7-2MXG Gitea: Public-only API token restriction is not enforced on team API routes

Summary Gitea's /api/v1/teams/id API routes do not correctly enforce the public-only access token restriction. A public-only token is intended to limit API access to public repositories and public organizations. However, several team API routes continue to return private team repository metadata...

GHSA-3PWW-VCVM-3GMJ Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Summary A Gitea personal access token PAT restricted to a non-repository scope e.g. read:issue can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied 403 on /raw, /media, /archive, and the...

XML Injection

Overview @astrojs/rss is an Add RSS feeds to your Astro projects Affected versions of this package are vulnerable to XML Injection via the source.title and enclosure.type fields, which are interpolated directly into XML templates without proper escaping. An attacker can inject arbitrary XML...

@astrojs/rss: XML Injection via Unescaped RSS Feed Fields

Summary In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS...

CVE-2026-44507

creationtimestamp| type| source ---|---|--- 2026-07-20 22:08:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4cnbk5rs2x...

CVE-2026-44231 RT: Privilege escalation and information disclosure via REST 2.0 user collection endpoint

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged non-administrative user can obtain authentication credentia...

CVE-2026-44231

CVE-2026-44231 affects RT REST 2.0: a privileged (non-administrative) user can obtain authentication credentials belonging to other users (including admins) and use them to read data via RT’s feed endpoints. The same request that exposes credentials also rotates them, invalidating existing feed U...

EUVD-2026-45877

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...

CVE-2026-10724 Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...

CVE-2026-10724

The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode ...