CVE-2026-87973 If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...

CVE-2026-87973

The If-So Dynamic Content WordPress plugin (versions 1.9.9 through 1.10.1 ) is vulnerable to Stored XSS due to a failure to sanitize conversion names before storage and a failure to escape them when rendering the analytics page. This allows users with editor-level access to inject and execute arb...

EUVD-2026-90513

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...

ROOT-APP-MAVEN-CVE-2026-47691 CVE-2026-47691 in io.netty:netty-resolver-dns - Patched by Root

Root has patched CVE-2026-47691 in the io.netty:netty-resolver-dns package for Root:Maven. Multiple fixed versions available...

PT-2026-104041

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as .. into the knowledge base name parameter to write knowledge base content to arbitrary locations outside the...

CVE-2026-64950: Improper Neutralization of Input During Web Page Generation

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

PT-2026-103768

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

The vulnerability of the WiresharkZipHelper::unzip() function in the Wireshark network traffic analyzer allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the WiresharkZipHelper::unzip function in the Wireshark network traffic analyzer is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability could allow a attacker to cause service failures or execute arbitrary code...

ROS-20261001-73-0020

The vulnerability in Go-Git relates to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

ROS-20261001-73-0053

The vulnerability in rclone relates to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

ROS-20261001-73-0023

The vulnerability in glib2 relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-105859

Impact What kind of vulnerability is it? Who is impacted? It has two related instances that share the same root cause: a user-controlled model field is assigned verbatim to a form field's help text, which is rendered with Django's |safe filter render field.html, bypassing auto-escaping. In both...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (ALMALINUX9.6:CLSA-2026:1779806430)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779806430 advisory. - Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find...

PT-2026-105118

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

PT-2026-105148

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

PT-2026-105146

php openssl matches wildcard name in ext/openssl/xp ssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes th...

PT-2026-103773

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount wizard/discount config during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code t...

Rocky Linux 8 [CIQ] Security Update: dnsmasq / dnsmasq-debuginfo / dnsmasq-debugsource / dnsmasq-utils / etc (crlsa-2021_4153)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214153 advisory. dnsmasq: fixed outgoing port used when --server is used with an interface name CVE-2021-3448 Tenable has extracted the preceding description block directly from the...

AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1776766448)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776766448 advisory. - NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpdavmodule module that might allow an attacker to trigger a buffer...

PT-2026-103774

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;...