PT-2026-97268

Name of the Vulnerable Software and Affected Versions Microweber affected versions not specified Description Reflected Cross-Site Scripting XSS occurs in the administration panel. The issue exists within the /admin/settings endpoint via the group parameter. An attacker can trick an authenticated...

CVE-2026-5696: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This...

EUVD-2026-84624

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-43643

Softaculous Virtualizor versions before 3.2.9 (Patch 9) and 3.0.0 are susceptible to an authorization bypass vulnerability in the billing module handler. An unauthenticated remote attacker can modify any tenant's account balance by sending a POST request to the admin panel dispatcher with crafted...

CVE-2026-89412 TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel v-html on suggestion.original in all versions up to, and including, 3.3.5 due to insufficient input sanitization and outp...

PT-2026-96760

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking get page content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary...

PT-2026-96650

Name of the Vulnerable Software and Affected Versions TranslatePress versions prior to 3.3.6 Description Insufficient input sanitization and output escaping in the Translation Memory Suggestion Panel allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. Attackers can inject...

SUSE CVE-2026-76154

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

CVE-2026-79316: Improper Access Control

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

pterodactyl

Pterodactyl — HackTheBox ウォークスルー プラットフォーム: HackTheBox | OS: Linux 攻撃チェーン サブドメイン上に Pterodactyl Panel が公開されていた。CVE-2025-49132 のパストラバーサルにより、認証なしで Laravel アプリケーションキーとデータベース認証情報が漏洩する。抽出したハッシュをクラックすることで SSH アクセスを取得する。権限昇格は CVE-2025-6018（PAM 環境変数ポイズニングにより偽のグラフィカル polkit セッションを作り出す）と CVE-2025-6019（XFS...

CVE-2026-76154 CVE-2026-76154 CVE Record

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

EUVD-2026-82430

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

SUSE CVE-2026-89824

In the Linux kernel, the following vulnerability has been resolved: drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter reference on probe failure e.g. probe deferral and on driver unbind also if a devicetree redundantly uses the 'ddc-i2c-bus' property to point ...

EUVD-2026-81290

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...

CVE-2026-54507: Server-Side Request Forgery (SSRF)

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

CVE-2026-14311: Missing Authorization

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated...

CVE-2026-92590

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...

CVE-2026-92593

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794. The Controller::getPostedRedirectUrl() → View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit introduced a self-signing oracle in Cp::elementLabelHtml(). Because Craft/Yii HMAC token...

CVE-2026-92590 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...

CVE-2026-92590 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...