CVE-2026-30819

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting XSS vulnerability in its dashboard revert functionality with the parameter dashboardid in /pages/ajax.render.php. This issue has been fixed in version 3.2.3...

CVE-2026-31803: Improper Neutralization of Input During Web Page Generation

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3...

coop (>=6.3.0, <=6.3.8), texsite (5.0.0) +7 more potentially affected by unknown CVE via wagtail (6.3.8)

wagtail PYPI version 6.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =6.3.0, =2.2.0, =2.2.2 Source cves: unknown CVE Source advisory: OSV:GHSA-JM5P-837G-RV8G...

coop (>=2.0.3, <=2.0.4), molo-core (>=8.0.0, <=8.0.2) +7 more potentially affected by unknown CVE via wagtail (2.0.2)

wagtail PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =2.0.3, =8.0.0, =8.0.0, =0.1.0, =1.0.0, =0.7.0, =1.0.0, =1.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-C2XX-CJMH-9Q8F...

coop (>=6.3.0, <=6.3.8), texsite (5.0.0) +7 more potentially affected by unknown CVE via wagtail (6.3.8)

wagtail PYPI version 6.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =6.3.0, =2.2.0, =2.2.2 Source cves: unknown CVE Source advisory: OSV:GHSA-92HV-J533-69WC...

Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles

Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...

coop (>=6.3.0, <=6.3.8), texsite (5.0.0) +7 more potentially affected by CVE-2026-54261 via wagtail (6.3.8)

wagtail PYPI version 6.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =6.3.0, =2.2.0, =2.2.2 Source cves: CVE-2026-54261 Source advisory: OSV:GHSA-R6P4-GRQ7-XM4M...

aratinga (0.1.0a0.dev3), coop (>=7.1.0, <=7.2.1) +7 more potentially affected by CVE-2026-54261 via wagtail (>=7.1.0, <=7.2.3)

wagtail PYPI version =7.1.0, =7.1.0, =1.1.1, =2.0.0, =0.0.1, =7.1.0a1, =7.2.0b0 Source cves: CVE-2026-54261 Source advisory: OSV:GHSA-R6P4-GRQ7-XM4M...

coop (>=6.3.0, <=6.3.8), texsite (5.0.0) +7 more potentially affected by CVE-2026-54260 via wagtail (6.3.8)

wagtail PYPI version 6.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =6.3.0, =2.2.0, =2.2.2 Source cves: CVE-2026-54260 Source advisory: OSV:GHSA-F2P5-J6FG-5CXF...

EUVD-2026-63222

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

WordPress Child Pages Card plugin < 1.09 - Contributor+ Stored XSS via Shortcode Attributes vulnerability

Contributor+ Stored XSS via Shortcode Attributes vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Child Pages Card versions 1.09...

WordPress Term Pages plugin < 2.0.0 - Unauthenticated SQL Injection via tp_lookup vulnerability

Unauthenticated SQL Injection via tplookup vulnerability discovered by João Ramos Maciel in WordPress Plugin Term Pages versions 2.0.0...

kernel: mm/huge_memory: update file PMD counter before folio_put()

A flaw was found in the Linux kernel's memory management, specifically within the huge page mechanism. When a huge page is split, the system updates a counter after releasing a reference to the memory. This timing issue can lead to the system attempting to read from memory that has already been...

PT-2026-80770

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.9 Wagtail versions prior to 7.3.4 Wagtail versions prior to 7.4.3 Wagtail versions prior to 8.0rc2 Description The internal Pages admin API returns page fields declared in api fields without sufficient access...

PT-2026-80213

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in api fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api fields on the base page model title, slug, s...

CVE-2026-74514

A flaw was found in the KVM Kernel-based Virtual Machine s390 PCI component. Incorrect memory accounting in the accountmem and unaccountmem functions, specifically related to the handling of pinned and unpinned pages, can lead to a resource leak. This occurs because the reference count for user...

CVE-2026-64851

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss because it contains no literal less-than character, then...

CVE-2026-64851 Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss because it contains no literal less-than character, then...

CVE-2026-64851 Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss because it contains no literal less-than character, then...

WordPress Nested Pages plugin < 3.2.15 - Editor+ Stored XSS via Post Title vulnerability

Editor+ Stored XSS via Post Title vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Nested Pages versions 3.2.15...