Malicious code in alphalend-layouts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fddd94a1329de9e53295705e2344e18fc7c3620804cbb3cda3c81e7ba0e7727e The package harvests installer-side secrets and uploads them to an attacker-controlled GitHub repository, executing both when pip install...

CVE-2026-66684

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

EUVD-2026-54091

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...

CVE-2026-18359 Server-Side Request Forgery (SSRF) in eScriptorium

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...

CVE-2026-18276 Missing Authorization in eScriptorium

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

EEF-CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Summary Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to...

CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

EUVD-2026-53895

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66684 WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66684 WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66684

The CVE-2026-66684 entry concerns the WordPress plugin Export Import Menus, affected versions ≤ 1.9.2. The vulnerability is an unauthenticated sensitive data exposure in the export/import functionality. No concrete exploit details, affected files, root cause, or remediation are provided in the av...

CVE-2026-66684

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the WSDL/XSD import process. An attacker can access sensitive files or internal resources by supplying crafted XML documents containing external entity references, which are processed when imported...

CVE-2026-65432

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied...

POC_platform

🛡️ POC Management Platform Local POC/EXP Management Platform:...

WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export Import Menus versions = 1.9.2...

CVE-2026-65432

The Apache CXF library is vulnerable to XML External Entity (XXE) attacks because it fails to extend protections to imported content. While Apache CXF uses a hardened StaxUtils path to disable DTDs and external entities for top-level WSDLs, any or references are passed to WSDL4J . Unlike CXF, W...

CVE-2026-65432 Apache CXF: XXE via WSDL/XSD import parsing

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied...