CVE-2026-76453: Improper Neutralization

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-67273

Dell Container Storage Modules, versions prior to 1.18.0, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

EUVD-2026-93457

Dell Container Storage Modules, versions prior to 1.18.0, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

PT-2026-106765

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules versions prior to 1.18.0 Description An improper neutralization of special elements used in a template engine allows a low privileged attacker with remote access to potentially achieve elevation of privileges...

CVE-2026-105791: Improper Neutralization of Argument Delimiters in a Command

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the runshell tool in the CommandLineExecutor component of ufo/client/mcp/localservers/climcpserver.py validates only the first token of the bashcommand parameter and permits...

CVE-2026-104040: Improper Neutralization of Delimiters

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol OData queries. A low-privileged local user can exploit this flaw by submitting a crafted...

CVE-2026-106119: Improper Neutralization of Special Elements in Data Query Logic

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...

CVE-2026-104396 WordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeroen Peters Name Directory name-directory allows Stored XSS.This issue affects Name Directory: from n/a through 1.34.2...

CVE-2026-103084 WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.109...

CVE-2026-105069

The Nikki Blight QR Redirector WordPress plugin (versions n/a through 2.0.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are stored o...

CVE-2026-104400 WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8...

CVE-2026-104409

The WP Chill Image Photo Gallery Final Tiles Grid plugin (specifically the final-tiles-grid-gallery-lite component) is vulnerable to Stored Cross-Site Scripting (XSS) in versions 3.6.13 and below . The root cause is the improper neutralization of input during web page generation . Exploitation de...

CVE-2026-105679: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

CVE-2026-105315: Improper Neutralization of Directives in Dynamically Evaluated Code

A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the component morelikethis Template Tag Handler. Such manipulation of the argument resultclass leads to improper neutralization of directives i...

CVE-2026-104400: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins B Blocks b-blocks allows Stored XSS.This issue affects B Blocks: from n/a through 2.1.8...

CVE-2026-103344

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to the improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 2.0.20 . Exploitation details ...

CVE-2026-103354 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1...

CVE-2026-103354 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1...

CVE-2021-22204

CVE-2021-22204 - ExifTool 任意代码执行 这是针对 CVE-2021-22204 的升级版概念验证（PoC），该漏洞影响 ExifTool 7.44 至 12.23 版本，在处理恶意 DjVu 文件时可导致任意代码执行。 致谢 本文为衍生作品。该漏洞及原始利用代码并非本人所发现。 角色| 人员 ---|--- 漏洞发现者| William Bowling @wcbowling，通过 GitLab 漏洞赏金计划提交 — 2021 年 4 月 原始 PoC 作者| UNICORD NicPWNs & Dev-Yeoj 本仓库修改者| d4ytox 描述 ExifToo...

PT-2026-104585

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor Free Widgets, Addons, Templates versions prior to 2.0.21 Description An issue involving improper neutralization of input during web page generation allows for Reflected Cross-site Scripting XSS, a technique whe...