CVE-2026-87888 YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin befor...

CVE-2026-89268 QloApps through 1.7.0 Reflected XSS via List Filter Parameters

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-89268 QloApps through 1.7.0 Reflected XSS via List Filter Parameters

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

PT-2026-90554

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-89240

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

CVE-2026-89240 WWBN AVideo Reflected XSS via confirmLivePassword.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

CVE-2026-89240

WWBN AVideo (through commit c3edcc27) contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The unauthenticated GET parameter u, not covered by $securityFilter, is interpolated directly into an attribute without URL- or HTML-encoding. A remote attacker c...

EUVD-2026-76052

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

PT-2026-90495

Name of the Vulnerable Software and Affected Versions Zeta Marketing Platform ZMP version 1.0 Description A reflected cross-site scripting XSS issue exists in the p.rfihub.com component. This occurs when the application fails to properly sanitize the ca parameter, allowing an attacker to execute...

Linux Distros Unpatched Vulnerability : CVE-2026-88058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, a...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Beets vulnerability (USN-8747-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8747-1 advisory. It was discovered that Beets incorrectly escaped untrusted media metadata in its web interface. An attacker could...

CVE-2026-79035

The Zeta Marketing Platform (ZMP) v1.0 is affected by a reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component. This flaw occurs due to the improper neutralization of input during web page generation, specifically when an attacker injects a crafted URL into the ca parame...

CVE-2026-89243: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setGroupname that fails to sanitize groupname input. Administrators with canAdminUserGroups permission can inject malicious HTML and JavaScript that executes in...

PT-2026-89843

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

PT-2026-89856

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filter var..., FILTER VALIDATE URL, which...

CVE-2026-79035: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the p.rfihub.com component of Zeta Marketing Platform ZMP v1.0 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted URL into the ca parameter...

CVE-2026-79035

A reflected cross-site scripting XSS vulnerability in the p.rfihub.com component of Zeta Marketing Platform ZMP v1.0 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted URL into the ca parameter...

DEBIAN-CVE-2026-88060

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes untrusted input inside template content nested in...

CVE-2026-88060

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes untrusted input inside template content nested in...

CVE-2026-88060 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes untrusted input inside template content nested in...