CVE-2026-86444

The LearnPress WordPress plugin versions prior to 4.4.7 is vulnerable to Reflected XSS due to improper neutralization of input. The root cause is the failure to escape user-supplied values before they are used in an HTML attribute on a public page. This allows unauthenticated attackers to execute...

EUVD-2026-80191

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-92217

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

PT-2026-93596

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the s390/vfio-ap component during queue probe. When the vfio ap mdev probe queue function creates the sysfs attribute group, the driver data for the...

PT-2026-93301

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

PT-2026-94031

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 1.10.0 through 1.32.0 Description The attribute truncation path in sdk/trace/span.go fails to enforce the AttributeValueLengthLimit for string and string-slice attributes that contain the Unicode replacement character...

CVE-2026-61598: Improperly Controlled Modification of Dynamically-Determined Object Attributes

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.mixins.modelbinding.ModelBindingMixin provides a default updatemodel event handler and is part of the LiveView base MRO, so every LiveView exposes it. It...

CVE-2026-86444: Improper Neutralization of Input During Web Page Generation

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

CVE-2026-84829: Improper Neutralization of Input During Web Page Generation

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

CVE-2026-81898

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

CVE-2026-45579

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py exportgetRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to...

CVE-2026-81898 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

CVE-2026-81898 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

CVE-2026-81898 Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

EUVD-2026-78900

In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Express association views. A user able to submit an Address attribute could execute script in the session of any dashboard user who opened the affected entry. The...

CVE-2026-81898

In Concrete CMS below version 9.5.3 , the Address attribute's country-less text formatter skipped HTML-escaping, enabling a stored XSS in Express association views. A low-privilege user able to submit an Address attribute with a blank (non-required) country field could inject script that executes...