CVE-2026-71513

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...

EUVD-2026-64296

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...

CVE-2026-71513 NLTK 3.10.0 through 3.10.2 Remote Code Execution via AllowlistUnpickler Dotted-Name Bypass

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside the allowlisted namespace. Attackers can craft...

CVE-2026-4559 Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-4559 Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-16260

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

EUVD-2026-64216

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

PT-2026-84277

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.15 @xmldom/xmldom versions prior to 0.9.12 xmldom versions 0.6.0 and earlier Description In the DOMHandler.startElement function within lib/dom-parser.js, every parsed attribute is inserted using...

PT-2026-79699

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap out-of-bounds read exists in the NCSI Network Controller Sideband Interface implementation. The function ncsi send cmd nl uses the length field from the ncsi pkt hdr structure to...

PT-2026-79551

Name of the Vulnerable Software and Affected Versions Image Photo Gallery Final Tiles Grid versions prior to 3.6.13 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is...

PT-2026-79716

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A type confusion issue exists in the notification logic of the pmbus module. In the pmbus notify function, the code unconditionally casts every attribute to a struct sensor device...

PT-2026-79554

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description An issue exists in the AllowlistUnpickler component that fails to validate the global name, validating only the pickle module string. This allows attackers to resolve dotted names via attribute travers...

Linux Distros Unpatched Vulnerability : CVE-2026-71513

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name,...

PT-2026-84281

Name of the Vulnerable Software and Affected Versions xmldom versions 0.9.11 through 0.9.11 Description The requireWellFormed: true element and attribute name checks use an anchored QName exact expression produced by the reg function in lib/grammar.js that inherits the multiline flag. This allows...

PT-2026-79507

Name of the Vulnerable Software and Affected Versions Post Grid, Slider & Carousel Ultimate versions prior to 1.8.1 Description Insufficient sanitization and escaping of a custom post type setting allows users with the Contributor role and above to perform a stored Cross-Site Scripting XSS attack...

CVE-2026-53468

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

EUVD-2026-64169

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-53468 Typemill has Stored HTML Attribute Injection in Metadata Fields

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

CVE-2026-53468

Typemill versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). The root cause is missing output encoding , allowing an authenticated user with permission to modify page metadata to inject arbitrary HTML attributes int...