WordPress SureForms cross-site scripting vulnerability

WordPress SureForms versions 2.12.9 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper handling of script-related HTML tags, potentially leading to code injection...

RHCOS 4 : Red Hat build of MicroShift 4.19.53 (RHSA-2026:91191)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91191 advisory. - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 - mime: golang:...

PT-2026-130678

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-132848

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in web/html/memorando/listar despachos.php results from unsafe handling of the texto field. The affected flow spans web/controle/memorando/DespachoControle.php and...

WordPress LiteSpeed Cache cross-site scripting vulnerability

WordPress LiteSpeed Cache versions 7.9.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping for the comment parameter, allowing unauthenticated attackers to inject arbitrary web scripts that are executed when...

CVE-2026-111418: Foxit Software Inc. foxit.com: A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service

A server-side request forgery SSRF vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources...

CVE-2026-111417: Foxit Software Inc. foxit.com: A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the…

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users...

WordPress Brave cross-site scripting vulnerability

WordPress Brave versions 0.8.8 and earlier contain a cross-site scripting vulnerability. This flaw stems from improper handling of script-related HTML tags within web pages, making them susceptible to basic cross-site scripting attacks that could lead to code injection...

WordPress Kirki cross-site scripting vulnerability

WordPress Kirki versions 6.4.0 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper handling of script-related HTML tags within web pages, potentially leading to code injection...

RHEL 6 : python-lxml (RHSA-2026:90336)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:90336 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Foxit.com authorization issue vulnerability

Versions of Foxit prior to 2026-10-29 contain an authorization issue vulnerability. This vulnerability arises because the HTML-to-PDF conversion service uses shared tokens for submitted conversion documents; improper access control may allow unauthorized users to access documents submitted by oth...

ROS-20261029-73-0004

The vulnerability in the TabStrip component of Google Chrome and Microsoft Edge is related to improper memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted HTML page...

WordPress User Registration & Membership Cross-site Scripting Vulnerability

WordPress User Registration & Membership versions 5.3.0 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper handling of script-related HTML tags within web pages, potentially leading to code injection...

CVE-2026-16889: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does…

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

PT-2026-130686

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Core & HTML component...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

firefox: firefox: Sandbox escape via use-after-free in DOM component

A flaw was found in Firefox. A use-after-free memory flaw in the Document Object Model DOM Core and HTML component allows a remote attacker to perform a sandbox escape. By enticing a user to visit a specially crafted web page, an attacker can leverage this vulnerability to execute arbitrary code...

firefox: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...