CVE-2026-4353 CI HUB Connector <= 1.2.106 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The CI HUB Connector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the cihubmetadata shortcode in all versions up to, and including, 1.2.106 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-4089 Twittee Text Tweet <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Twittee Text Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in all versions up to and including 1.0.8. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The ttttwitteetweeter...

CVE-2026-4089 Twittee Text Tweet <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Twittee Text Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in all versions up to and including 1.0.8. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The ttttwitteetweeter...

CVE-2026-4089

CVE-2026-4089 affects the WordPress plugin Twittee Text Tweet (≤ 1.0.8). The vulnerability is a Stored Cross-Site Scripting flaw in the ttt_twittee_tweeter() function where shortcode attributes (notably id, tweet, content, balloon, theme) are extracted and concatenated into HTML/inline JavaScript...

GHSA-XX5W-CVP6-JV83 vulnerabilities

Vulnerabilities for packages: wizer, wasmcloud, yara-x, zed...

CVE-2026-41665

Integer overflow in scratch buffer initialization size calculation in Samsung Open Source ONE cause incorrect memory initialization for large intermediate tensors. Affected version is prior to commit 1.30.0...

CGA-JQ5V-33FJ-FVCJ

Bulletin has no description...

GHSA-CCQ9-R5CW-5HWQ

creationtimestamp| type| source ---|---|--- 2026-04-22 01:18:49+00:00| published-proof-of-concept| Telegram/AsK9uQCoE0LPzwbkNe8abRZIpzVzCCIAKmN05DDH2W6pw...

GHSA-793Q-XGJ6-7FRP

creationtimestamp| type| source ---|---|--- 2026-04-22 01:18:49+00:00| published-proof-of-concept| Telegram/AsK9uQCoE0LPzwbkNe8abRZIpzVzCCIAKmN05DDH2W6pw...

EUVD-2026-24550

An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error...

PT-2026-34507

Name of the Vulnerable Software and Affected Versions uutils coreutils affected versions not specified Description The id utility exhibits incorrect behavior in its pretty print output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013682)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013682 advisory. In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid posixtimeradd tries to allocate a posix...

Linux Distros Unpatched Vulnerability : CVE-2026-35371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The id utility in uutils coreutils exhibits incorrect behavior in its pretty print output when the real UID and effective UID differ. The implementation...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013414)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013414 advisory. A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver...

PT-2026-34505

Name of the Vulnerable Software and Affected Versions uutils coreutils affected versions not specified Description An argument parsing error in the kill utility incorrectly interprets the command 'kill -1' as a request to send the default signal SIGTERM to PID -1. Sending a signal to PID -1 cause...

PT-2026-34444

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A rogue backend can send a crafted UDP response with a query ID off by one relative to the maximum configured value. This triggers an out-of-bounds write, which ...

WordPress plugin CI HUB Connector 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013639)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013639 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Add a length limitation for the ivrsacpihid command-line parameter The 'acpiid' buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-35370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to...

PT-2026-34315

The Gutentools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Slider block's block id attribute in all versions up to, and including, 1.1.3. This is due to insufficient input sanitization and output escaping combined with a custom unescaping routine that reintroduc...