CVE-2026-8623

The Dear Flipbook WordPress plugin (all versions up to 2.4.30 ) is vulnerable to an authenticated Stored Cross-Site Scripting (XSS) via the post_content parameter, specifically the class attribute of .dvcss elements. Attackers with Contributor-level access can embed a Base64-encoded JSON object i...

CVE-2026-8623 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

CVE-2026-8623 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

EUVD-2026-71788

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing...

SUSE CVE-2026-80767

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-after-free in enablesensor enablesensorstore can call setpowerreportstate, which dereferences sensorinst-powerstate and sensorinst-reportstate. These pointers refer to entries in sensorinst-fields...

SUSE CVE-2026-80805

In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfsattr3leafverifyentry accesses lentry/rentry fields namelen, valuelen before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the en...

SUSE CVE-2026-80869

In the Linux kernel, the following vulnerability has been resolved: ntfs: bound the attribute-list entry in ntfsreadinodemount The $MFT attribute-list walk in ntfsreadinodemount validates each entry only with "u8 alentry + 6 alend" and "u8 alentry + le16tocpualentry-length alend", but then reads...

SUSE CVE-2026-84371

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that...

CVE-2026-52774

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...

PT-2026-86351

🚨 CVE-2026-84899 The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected pos...

PT-2026-86349

🚨 CVE-2026-84896 The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the...

PT-2026-86307

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wp unslash...

PT-2026-86416

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

Linux Distros Unpatched Vulnerability : CVE-2026-86095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4HDF5inqattname that copies HDF5 attribute names into a fixed 256-byte buffer...

CVE-2026-86191: Authorization Bypass Through User-Controlled Key

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

CVE-2026-84021: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the...

CVE-2026-76573: Improper Neutralization of Input During Web Page Generation

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-84930: Improper Neutralization of Input During Web Page Generation

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

CVE-2025-14945: Improper Neutralization of Input During Web Page Generation

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wpunslash...

CVE-2026-83544: Improper Neutralization of Input During Web Page Generation

The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...