PT-2026-103261

Contributor Cross Site Scripting XSS in OAuth Server = 4.5.1 versions...

CVE-2026-103389: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...

CVE-2026-97266: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12.1 versions...

CVE-2026-96830: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.9 versions...

CVE-2026-96450: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in pixfort Core 4.3.3 versions...

CVE-2026-97067: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.7 versions...

CVE-2026-96819: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in oik = 4.15.4 versions...

CVE-2026-94077: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Safe SVG = 2.5.0 versions...

CVE-2026-97270: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...

CVE-2026-93464: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

PT-2026-103259

Name of the Vulnerable Software and Affected Versions WP Chill Strong Testimonials versions prior to 3.3.12 Description Stored Cross-site Scripting XSS occurs due to improper neutralization of input during web page generation. This allows a contributor to inject malicious scripts into the...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1781209763)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1781209763 advisory. - Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration This issue affects Apache HTTP...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc (ALMALINUX9.2:CLSA-2025:1753121138)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753121138 advisory. - A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2,...

AlmaLinux 8 : container-tools:rhel8 (ALSA-2026:63163)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:63163 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 encoding/asn1: golang: Go encoding/asn1: Denial of...

PT-2026-103234

Subscriber Cross Site Scripting XSS in JetEngine = 3.8.14.3 versions...

CVE-2026-102586: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

CVE-2026-102427: Unrestricted Upload of File with Dangerous Type

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...

PT-2026-103041

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

PT-2026-107988

Name of the Vulnerable Software and Affected Versions League CommonMark versions 1.3.0 through 2.10.1 Description An issue exists where users posting Markdown can bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. This allows attackers to insert a lone scri...

CVE-2026-103439: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting XSS. This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43...