EUVD-2026-70910

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

UBUNTU-CVE-2026-85504

FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses...

CVE-2026-79675

A flaw was found in NLTK. When processing untrusted input for its per-call options parameter in the java function, NLTK fails to validate Java Virtual Machine JVM options. A remote attacker could exploit this by injecting dangerous JVM flags, such as -agentpath or -javaagent, to achieve arbitrary...

CVE-2026-85504

FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses...

CVE-2026-85504

FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

EUVD-2026-70815

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...

EUVD-2026-70814

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

EUVD-2026-70767

There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0...

PT-2026-85527

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...

PT-2026-85780

CVE-2026-38961: Stored XSS in Netgate pfSense RSS Widget versions 26.03, 25.11.1, CE 2.8.1. Malicious feed titles execute JS for any authenticated user viewing the dashboard. CVSS: N/A. Unpatched—restrict RSS access now. Details: https://t.co/XaOt7Xazw4 cybersecurit valtersit CVE CVEAlert infosec...

PT-2026-85448

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

PT-2026-85580

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract as object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

PT-2026-85530

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

ROS-20260904-73-0017

The vulnerability of the Repo.clonefrom function in the Python library for interacting with Git repositories in GitPython is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code remotely...

PT-2026-85533

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...

PT-2026-85525

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash fileupload process' function, which iterates through an entire array and validates only the first file. This...

CVE-2026-85504

FreeIPMI before 1.6.19 has a stack-based buffer overflow in ipmiseloemfujitsugetselentrylongtext in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses...