PT-2026-99124

Name of the Vulnerable Software and Affected Versions Mediawiki - Wikibase Extension versions prior to 1.46.1 Mediawiki - Wikibase Extension version 1.45.5 Mediawiki - Wikibase Extension version 1.43.10 Description Improper neutralization of input during web page generation allows for Cross-Site...

CVE-2026-100380: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-96878: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96876: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-14281: Improper Privilege Management

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route POST...

CVE-2026-97735: Improper Neutralization of Input During Web Page Generation

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

PT-2026-98871

Name of the Vulnerable Software and Affected Versions Mediawiki - Cargo extension versions prior to 3.9.5 Description Improper neutralization of input during web page generation in the Mediawiki - Cargo extension allows Stored Cross-Site Scripting XSS, a condition where malicious scripts are...

PT-2026-98397

Name of the Vulnerable Software and Affected Versions Repeater Fields for Elementor Forms versions prior to 2.2.8 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into...

PT-2026-99105

Name of the Vulnerable Software and Affected Versions Mediawiki - Cargo extension versions prior to 3.9.5 Description Improper neutralization of input during web page generation leads to a Reflected Cross-Site Scripting XSS issue. Cross-Site Scripting is a flaw that allows an attacker to inject...

PT-2026-98362

Name of the Vulnerable Software and Affected Versions Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress versions prior to 4.8.7 Description An issue exists due to missing permission enforcement on the publicly accessible REST route POST...

EUVD-2025-211003

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

CVE-2025-51457

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands...

PT-2026-106309

Summary The /home/file path:path endpoint in web client.py serves static files by directly concatenating the user-supplied file path with the home directory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequenc...

PT-2026-98909

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description The Web STOMP WebSocket handler fails to enforce max frame size and log...

PT-2026-98862

Name of the Vulnerable Software and Affected Versions IBM Server Firmware versions FW1120.00 through FW1120.01 IBM Server Firmware versions FW1110.00 through FW1110.31 IBM Server Firmware versions FW1060.00 through FW1060.81 IBM Server Firmware versions FW950.00 through FW950.H3 Description A fla...

Linux Distros Unpatched Vulnerability : CVE-2026-67230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesiz...

CVE-2026-93306: Out-of-bounds Read

IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI,...

CVE-2026-100383: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...

Security update for MozillaFirefox (important)

openSUSE security update: security update for mozillafirefox ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21951-1 Rating: important References: bsc1280371 Cross-References: CVE-2026-92005 CVE-2026-92006 CVE-2026-92007 CVE-2026-92008 CVE-2026-9200...

The vulnerability of the golang-x-net package in the Golang programming language arises from the lack of security measures for handling web page structures, allowing attackers to execute arbitrary code.

The vulnerability of the golang-x-net package in the Golang programming language is related to the lack of protective measures for web page structures. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...