CVE-2026-94077: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Safe SVG = 2.5.0 versions...

CVE-2026-97270: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...

CVE-2026-93464: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

PT-2026-103259

Name of the Vulnerable Software and Affected Versions WP Chill Strong Testimonials versions prior to 3.3.12 Description Stored Cross-site Scripting XSS occurs due to improper neutralization of input during web page generation. This allows a contributor to inject malicious scripts into the...

Linux Distros Unpatched Vulnerability : CVE-2026-55214

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website field...

Linux Distros Unpatched Vulnerability : CVE-2026-100821

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird...

PT-2026-103234

Subscriber Cross Site Scripting XSS in JetEngine = 3.8.14.3 versions...

CVE-2026-102586: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

CVE-2026-102427: Unrestricted Upload of File with Dangerous Type

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing task=getContent, a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates th...

PT-2026-103041

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

PT-2026-107988

Name of the Vulnerable Software and Affected Versions League CommonMark versions 1.3.0 through 2.10.1 Description An issue exists where users posting Markdown can bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. This allows attackers to insert a lone scri...

CVE-2026-103439: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting XSS. This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43...

PT-2026-103069

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-88037: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title attribute of the btbbservice shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2026-103288

MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1752126532)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1752126532 advisory. - modlua.c in the modlua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in whic...

AlmaLinux 8 : container-tools:rhel8 (ALSA-2026:63163)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:63163 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 encoding/asn1: golang: Go encoding/asn1: Denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-100816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

SUSE CVE-2026-100816

Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

SUSE CVE-2026-100821

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...