CVE-2026-82883

CVE-2026-82883 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Login With Ajax by Marcus , affecting versions from n/a through 4.5.1 . The root cause is improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts th...

CVE-2026-82883: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

Canadian Man Pleads Guilty in Snowflake Extortions

A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud provider Snowflake. Connor Riley Moucka , of Kitchener, Ontario, also...

WordPress Calendar plugin < 1.3.18 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Marcus Cornes in WordPress Plugin Calendar versions 1.3.18...

CVE-2026-57713: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Marcus aka @msykes Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through = 7.3.6...

CVE-2026-22351: Missing Authorization

Missing Authorization vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP FullCalendar: from n/a through = 1.6...

PT-2026-21199

Name of the Vulnerable Software and Affected Versions WP FullCalendar versions through 1.6 Description The WP FullCalendar software contains a missing authorization flaw. This allows exploitation of incorrectly configured access control security levels. No information is available regarding the...

CVE-2026-24523: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through = 1.6...

A Bootiful Podcast: The Vaadin team, live from Vaadin Create 2025

Hi, Spring fans! In this installment, I had the privilege to sit down with Vaadin legends Joonas Lehtinen, Marcus Hellberg, and Leif Åstrand at the amazing Vaadin Create 2025 event in Frankfurt, Germany...

Ubuntu: Security Advisory (USN-7363-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-1249: Missing Authorization

Missing Authorization vulnerability in Marcus aka @msykes Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through = 6.6.4.1...

CVE-2025-22576

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Downing Site PIN site-pin allows Reflected XSS.This issue affects Site PIN: from n/a through = 1.3...

CVE-2025-22260: Missing Authorization

Missing Authorization vulnerability in Marcus aka @msykes Meta Tag Manager meta-tag-manager.This issue affects Meta Tag Manager: from n/a through = 3.1...

Drupal AI (Artificial Intelligence) module < 1.0.2 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Marcus Johansson in WordPress Module AI Artificial Intelligence versions 1.0.2...

CVE-2025-22576

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Downing Site PIN site-pin allows Reflected XSS.This issue affects Site PIN: from n/a through = 1.3...

CVE-2025-22576 WordPress Site PIN Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Downing Site PIN site-pin allows Reflected XSS.This issue affects Site PIN: from n/a through = 1.3...

CVE-2025-22576 WordPress Site PIN Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Downing Site PIN allows Reflected XSS.This issue affects Site PIN: from n/a through 1.3...

CVE-2025-22261: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Stored XSS.This issue affects WP FullCalendar: from n/a through = 1.5...

CVE-2023-49859: Missing Authorization

Missing Authorization vulnerability in Marcus aka @msykes Login With Ajax login-with-ajax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login With Ajax: from n/a through = 4.1...

A Bootiful Podcast: Vaadin developer advocacy legend Marcus Hellberg

Hi, Spring fans! In this installment, I talk to Vaadin developer advocacy legend Marcus Hellberg about the lates-and-greatest in the wide and wonderful world of Spring...