CVE-2026-119098

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'answer' parameter in all versions up to, and including, 10.3.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-119098

The LifterLMS WordPress plugin (versions up to and including 10.3.2 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists in the 'answer[]' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access ...

CVE-2026-119098 LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'answer' parameter in all versions up to, and including, 10.3.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-118561

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'answer' parameter in all versions up to, and including, 10.3.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-85570 Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure

The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to...

CVE-2026-85570

The Tutor LMS WordPress plugin (versions before 4.2.0 ) contains a vulnerability where correct answers to quiz questions are incorrectly included in the page served to students. This occurs regardless of the plugin's settings intended to control answer visibility, potentially allowing any enrolle...

WordPress Tutor LMS plugin < 4.2.0 - Subscriber+ Quiz Answer Key Disclosure vulnerability

Subscriber+ Quiz Answer Key Disclosure vulnerability discovered by vuxvinh in WordPress Plugin Tutor LMS versions 4.2.0...

CVE-2026-121558

AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in metadataallowed in rag/agenticrag.py that allows authenticated users to read other projects' knowledge by supplying projectid. Attackers with read:knowledge scoped to one project can set context.projectid via GET...

CVE-2026-121558

The AuditPilot software (versions prior to commit 4669c93 ) is vulnerable to an authorization bypass within the _metadata_allowed function in rag/agentic_rag.py. This flaw allows authenticated users with read:knowledge permissions for a single project to access knowledge chunks from other project...

CVE-2026-121558: Ricky-7-Yan intelligent-audit-system: AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in…

AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in metadataallowed in rag/agenticrag.py that allows authenticated users to read other projects' knowledge by supplying projectid. Attackers with read:knowledge scoped to one project can set context.projectid via GET...

Pixel-Flood-Attack

Pixel Flood DoS - CVE-2024-22393 PoC Pixel Flood Bug for Web Servers A lightweight Proof-of-Concept to test for the Pixel Flood memory exhaustion vulnerability in web applications running vulnerable versions of Apache Answer. Table of Contents Description Technical Details Affected Versions...

CLEANSTART-2025-IR96707 "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model us...

Security vulnerability affects the bind package. "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers...

CLEANSTART-2025-WE95883 This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero

Security vulnerability affects the bind package. This issue can affect BIND 9 resolvers with stale-answer-enable yes; that also make use of the option stale-answer-client-timeout, configured with a value greater than zero...

CLEANSTART-2025-YP89956 BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query

Security vulnerability affects the bind package. BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to a positive integer, and the resolver receives an RRSIG query...

Apache-Hunter

ApacheHunter - Advanced Apache Server Scanner Developed by Rownok Ahmed Khan GitHub:https://github.com/Rk-000 ApacheHunter is a powerful scanner designed to detect Apache servers, identify versions, and check for CVE-2024-22393 Pixel Flood vulnerability in Apache Answer installations. Features ✅...

OESA-2026-4608 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

OESA-2026-4607 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

FlipJev: Fast Black-Box Red Teaming Finds Universal Adversarial Suffixes for Typed Decision Models

Typed decision models are an emerging class of language models that make decisions instead of generating free-text responses. They answer in a single fast and cheap query and are increasingly used, including in security-sensitive tasks. However, red teaming of these models leaves two gaps: existi...

CVE-2026-83813

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host...

DEBIAN-CVE-2026-83813

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host...