CVE-2026-7006

Sublime Text for Windows (Build 4192 / ST4 and Build 3207 / ST3) is vulnerable to a local privilege escalation via its update staging mechanism . An unprivileged local attacker can place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%, mark it read-only to bypass clean...

CVE-2026-15004

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15004 FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15004 FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15004

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via image alt text in all versions up to and including 6.5.6 . The root cause is insufficient input sanitization and output escaping . An attacker with Author-leve...

EUVD-2026-82757

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-7006: Download of Code Without Integrity Check

Sublime Text for Windows through Build 4192 Sublime Text 4 and Build 3207 Sublime Text 3 contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a...

CVE-2026-15004: Improper Neutralization of Input During Web Page Generation

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption cue text process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious content into closed captions. Details Cross-site scripting or XSS is a code...

Cross-site Scripting (XSS)

Overview @asicupv/paella-core is a Multi stream HTML video player Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption cue text process. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious content into close...

CVE-2026-54645

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php reads the description, descriptionshort, and speccopy rich-text fields from $GLOBALS'RAW''POST' and removes only script elements before the values are stored and rendered through Smarty templates. An...

CVE-2026-53534

JabRef , a desktop BibTeX/BibLaTeX manager, is affected by an operating-system command injection in its CAYW (Cite-As-You-Write) Sublime Text integration prior to 6.0-alpha.6 . When JabRef's built-in HTTP server or jabsrv is enabled, the GET /better-bibtex/cayw endpoint accepts an external comman...

CVE-2026-77615 Paella Player: Stored XSS via caption cue text

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 as used in Opencast prior to 19.7 and 20.2, there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11...

CVE-2026-77615 Paella Player: Stored XSS via caption cue text

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 as used in Opencast prior to 19.7 and 20.2, there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11...

CVE-2026-77615 Paella Player: Stored XSS via caption cue text

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 as used in Opencast prior to 19.7 and 20.2, there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11...

CVE-2026-77615

Paella Player , a set of libraries for building multi-stream video players, contains a stored XSS vulnerability via closed captions cue text . The flaw is exploitable when a user views maliciously crafted caption data, with an impact spanning confidentiality and integrity in a changed scope (CVSS...

BIT-MONGODB-2026-82056 Race Condition in MongoDB Server Text Index Query Parsing Leads to Heap Use-After-Free and Denial of Service

A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been...

BIT-MONGODB-2026-18699 Improper Input Validation in MongoDB Query Planner Leads to Denial of Service

An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connecte...

CVE-2026-92056

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Text component...

CVE-2026-77615: Improper Neutralization of Input During Web Page Generation

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 as used in Opencast prior to 19.7 and 20.2, there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11...