CVE-2026-88037: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title attribute of the btbbservice shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Linux Distros Unpatched Vulnerability : CVE-2026-55214

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website field...

PT-2026-103288

MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...

CVE-2026-103389: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated direct...

CVE-2026-103439: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting XSS. This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43...

CVE-2026-93464: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

PT-2026-103069

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...

CVE-2026-102586: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

PT-2026-103198

Contributor Cross Site Scripting XSS in pixfort Core 4.3.3 versions...

CVE-2026-96450: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in pixfort Core 4.3.3 versions...

PT-2026-103213

Contributor Cross Site Scripting XSS in The Plus Addons for Elementor Page Builder Lite = 6.5.1 versions...

CVE-2026-97270: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in CMB2 = 2.13.0 versions...

PT-2026-103263

Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...

PT-2026-103265

Contributor Cross Site Scripting XSS in King Addons for Elementor = 51.1.86 versions...

PT-2026-103259

Name of the Vulnerable Software and Affected Versions WP Chill Strong Testimonials versions prior to 3.3.12 Description Stored Cross-site Scripting XSS occurs due to improper neutralization of input during web page generation. This allows a contributor to inject malicious scripts into the...

CVE-2026-96830: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.9 versions...

CVE-2026-94077: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Safe SVG = 2.5.0 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-76154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in...

CentOS Linux 6 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ssl Multiple Vulnerabilities (CENTOS6:CLSA-2026:1781623309)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1781623309 advisory. - A cross-site scripting vulnerability exists in modproxyftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc (ALMALINUX9.2:CLSA-2025:1753121138)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753121138 advisory. - A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2,...