PT-2026-90055

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a condition where malicious scripts are injected into trusted websites. Th...

PT-2026-89857

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field name parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute...

PT-2026-89854

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start request...

PT-2026-90300

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the block subsystem where bio-based drivers may fail to check alignment splits, and stacking block drivers may not properly handle misalignment detected after bio...

PT-2026-90000

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in IdeaSoft Software Industry and Trade Inc. Smart E-Commerce allows Reflected XSS. This issue affects Smart E-Commerce: through 11092026. NOTE: The vendor was contacted early about this disclosure bu...

PT-2026-89842

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing / to close t...

ROS-20260911-73-0043

The vulnerability of Google Chrome and Microsoft Edge web browsers relates to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0178

The vulnerability of the Guest mode in Google Chrome browser is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to carry out spam attacks using a specially created HTML page...

ROS-20260911-73-0212

The vulnerability of the WebAppInstalls component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0208

The vulnerability of the File Input component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260911-73-0218

The vulnerability of Google Chrome’s Password Manager component is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to replace the user interface...

Apache ActiveMQ < 5.19.11 / 6.x < 6.3.2 clientId Spoofing

The version of Apache ActiveMQ running on the remote host is prior to 5.19.11 or 6.x prior to 6.3.2. It is, therefore, affected by a spoofing vulnerability: - Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An...

PT-2026-90159

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Intel Speed Shift Technology ISST platform driver for x86 architectures. The functions isst if get perf level mask and isst if get base freq mask use a user-provid...

ROS-20260911-73-0069

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ROS-20260911-73-0059

The vulnerability of the DeviceBoundSessionCredentials component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0189

The vulnerability in Google Chrome and Microsoft Edge relates to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted HTML page...

ROS-20260911-73-0171

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...

ROS-20260911-73-0130

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially crafted HTML page...

ROS-20260911-73-0230

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

CVE-2026-17037: Improper Neutralization of Input During Web Page Generation

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...