PT-2026-4418

Name of the Vulnerable Software and Affected Versions WP Messiah Ai Image Alt Text Generator for WP versions through 1.1.9 Description The Ai Image Alt Text Generator for WP software contains a missing authorization flaw. This allows exploitation due to incorrectly configured access control...

bloofoxCMS security vulnerabilities

BloofoxCMS is a content management system for text-based data, developed by the individual developer of bloofoxCMS. Version 0.5.2.1 of BloofoxCMS has a security vulnerability; this vulnerability stems from a storage-type XSS vulnerability in the articles text parameter, which may allow for the...

PT-2026-4325

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport function in all versions up to, and including, 3.6.15. This makes it possible for unauthenticated attackers to upload...

PT-2026-4519

Name of the Vulnerable Software and Affected Versions BloofoxCMS version 0.5.2.1 Description BloofoxCMS contains a stored cross-site scripting issue. Authenticated attackers can inject malicious scripts through the text parameter in the articles section. This allows for the execution of scripts a...

Thread Redirect plugin for MyBB – Cross-site scripting vulnerabilities

The Thread Redirect plugin for MyBB is a plugin developed by Jamie Sage, an individual developer. The Thread Redirect plugin for MyBB version 0.2.1 has a cross-site scripting vulnerability. This vulnerability stems from improper cleaning of custom text input fields, which may lead to cross-site...

CVE-2026-22849

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and...

EUVD-2026-3790

A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default configuration. The defect resulted in both authentication and authorization checks being bypassed, potentially allowing any network-accessible...

Malicious code in icloud-recovery (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3639028f2f9d36c20b55c655b1d71bc053827f4703e7954b12a4ec3da8edd8d2 On importing the module, the code exfiltrates text files, with the focus on configuration files --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-467 Malicious code in icloud-recovery (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3639028f2f9d36c20b55c655b1d71bc053827f4703e7954b12a4ec3da8edd8d2 On importing the module, the code exfiltrates text files, with the focus on configuration files --- Category: MALICIOUS - The campaign has clearly malicious...

EUVD-2026-3798

Cross-Site Request Forgery CSRF vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Cross Site Request Forgery.This issue affects RegistrationMagic: from n/a through = 6.0.6.9...

XSS-cheat-sheet-txt-dictionary-by-PortSwigger

XSS cheat sheet dictionary by PortSwigger PortSwigger diction...

SUSE CVE-2021-47853

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

Azure Linux 3.0 Security Update: multus (CVE-2020-28852)

The version of multus installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-28852 advisory. - In x/text in Go before v0.3.5, a slice bounds out of range panic occurs in language.ParseAcceptLanguage whil...

Azure Linux 3.0 Security Update: fltk (CVE-2016-10087)

The version of fltk installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2016-10087 advisory. - The pngsettext2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rich text fields fields. An attacker can execute arbitrary scripts in the context of other users by injecting malicious HTML content. Details Cross-site scripting or XSS is a code vulnerability that occu...

CVE-2026-22849

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and...

CVE-2026-22849 Saleor lacks proper HTML sanitization in rich text fields

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and...

CVE-2026-22849

Saleor (e-commerce platform) contains a stored XSS vulnerability in rich text fields due to missing backend HTML cleaning prior to versions 3.20.108, 3.21.43, and 3.22.27. The underlying issue is lack of HTML sanitization in rich text content, enabling malicious actors to inject scripts that coul...

CVE-2026-22849 Saleor lacks proper HTML sanitization in rich text fields

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and...

EUVD-2026-3777

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and...