CVE-2026-93339 Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute

Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...

CVE-2026-93339 Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute

Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...

CVE-2026-94404

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker...

CVE-2026-94404 MISP CSRF vulnerability allows unauthorized attribute modification

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker...

CVE-2026-94404 MISP CSRF vulnerability allows unauthorized attribute modification

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker...

CVE-2026-94404

MISP (Malware Information Sharing Platform) versions prior to 2.5.47 are affected by a CSRF vulnerability in its attribute modification function. The function did not properly enforce MISP's usual protection against forged requests, allowing an attacker to craft a malicious webpage that silently ...

CVE-2026-94404 MISP CSRF vulnerability allows unauthorized attribute modification

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker...

TencentOS Server 2: python-tornado (TSSA-2026:1040)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1040 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

SUSE CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-77820

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-83465

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-77820 WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-77820 WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-77820

WPComplete is a WordPress plugin vulnerable to Stored Cross-Site Scripting (XSS) via the 'empty' Shortcode Attribute in all versions up to and including 2.9.9.0 . The root cause is insufficient input sanitization and output escaping . Attackers with contributor-level access or higher can inject a...

CVE-2026-77820: Improper Neutralization of Input During Web Page Generation

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

Data deletion and attribute disclosure via field-name method injection in in-memory queries

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanent...

CVE-2026-93762

Mongoid (MongoDB's Ruby ODM) has an unsafe reflection weakness in the in-memory query path used for embedded documents . When an application passes an externally supplied field name to certain query methods, an unauthenticated attacker can achieve attribute disclosure of stored document data and ...

CVE-2026-93762 Data deletion and attribute disclosure via field-name method injection in in-memory queries

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanent...

CVE-2026-93762 Data deletion and attribute disclosure via field-name method injection in in-memory queries

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanent...

CVE-2025-61682

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0...