Linux Distros Unpatched Vulnerability : CVE-2026-118765

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeededRNG::clear and then calls randomize with an empty output buffe...

PT-2026-134523

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output dir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files...

PT-2026-134498

Name of the Vulnerable Software and Affected Versions WooCommerce Extra Product Options Pro versions prior to 3.3.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs on product pages where a Date ...

PT-2026-134438

The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitizatio...

CVE-2026-9811

CVE-2026-9811 CVE-2026-9811 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting Mautic 7 versions 7.0.0 through 7.1.1.The vulnerability exists in the Project Selector component, where project names returned via an AJAX request are inserted into the page without proper output...

CVE-2026-109781

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the Printing: Output component...

CVE-2026-62162

A flaw was found in Hydra. A remote attacker can intercept and steal committed funds by observing pending deposit transactions on the network. Because the deposit verification logic fails to properly constrain transaction outputs or verify protocol state, an attacker can submit a transaction...

cve-2026-6471-postgres-logical-decoding-dlopen

PostgreSQL CVE-2026-6471: logical decoding dlopen of an arbitrary library PostgreSQL logical decoding lets a non-superuser role that holds the REPLICATION privilege create a logical replication slot and choose the output plugin. On affected versions there is no authorization check on that choice,...

sast-scan-action

Offensive360 SAST Scan — GitHub Action Run a full Offensive360 static application security scan SAST on every push or pull request. Deep taint and data-flow analysis across 60+ languages, results as SARIF for the GitHub code scanning tab, and a severity gate for your pipeline. Free for open sourc...

CVE-2026-96894

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for...

CLEANSTART-2026-AV97578 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames

CVE-2026-39817 affects multiple packages. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames. See references for individual vulnerability details...

CVE-2026-96894 ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96894

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress (versions up to and including 1.17.10 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping when processing the Inbound Email Body . An un...

CVE-2026-96894 ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-114221

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-116552 Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header

The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPCLIENTIP Client-IP header' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-114216

The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTPCLIENTIP Client-IP header' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CLEANSTART-2026-OA04050 Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat

Security vulnerability affects the thingsboard package. Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat...

WSO2-2021-1261

WSO2-2021-1261: Multiple Cross-Site Scripting in WSO2 ESB Due to improper output encoding, multiple Cross Site Scripting XSS attacks have been identified in WSO2 ESB. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Why no CVE? Neither me nor the vendor...

CLEANSTART-2026-XY90665 "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames

CVE-2026-39817 affects multiple packages. The "go tool pack" subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames. See references for individual vulnerability details...