CVE-2026-18395 Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

SUSE CVE-2026-64569

In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mplsvalidfibdumpreq on CONFIGINET=n On CONFIGINET=n builds, mplsvalidfibdumpreq walks the parsed attribute table itself instead of calling ipvalidfibdumpreq. The RTAOIF arm passes tbRTAOIF to nlagetu32...

PT-2026-68404

Name of the Vulnerable Software and Affected Versions Child Pages Card WordPress plugin versions prior to 1.09 Description Insufficient sanitization and escaping of shortcode attributes before they are output on a page allows users with the contributor role and above to execute Stored Cross-Site...

CVE-2026-18395: Improper Neutralization of Input During Web Page Generation

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2026-75966

Impact With the Attributes extension enabled, AttributesListener::findTargetAndDirection resolves each attribute node's target by walking outward through its siblings. For a run of N adjacent inline attribute blocks placed at the start of a block with nothing to their left, each node scans the...

EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2948)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...

CVE-2026-53992

A reflected XSS in ProjectSend r2029 affects thumbnails-regenerate.php through unsanitized start_date and end_date GET parameters, which are echoed into HTML attributes. An attacker can craft a URL that, when opened by an authenticated user with edit_settings permissions, executes arbitrary HTML/...

CVE-2026-64569

In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mplsvalidfibdumpreq on CONFIGINET=n On CONFIGINET=n builds, mplsvalidfibdumpreq walks the parsed attribute table itself instead of calling ipvalidfibdumpreq. The RTAOIF arm passes tbRTAOIF to nlagetu32...

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

PT-2026-69023

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

ROS-20260805-73-0021

The vulnerability of the ntfslistea function in the fs/ntfs3/xattr.c module of the NTFS file system in the Linux operating system is related to reading data beyond the allowed limits of the data buffer. Exploiting this vulnerability could allow an attacker to access protected information or cause...

MGASA-2026-0321 Updated acl attr packages fix security vulnerabilities

The updated acl and attr packages fix security issues...

CVE-2026-25289

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

CVE-2026-25289

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

CVE-2026-25289

CVE-2026-25289 describes memory corruption/stack-based overflow when processing Device Capability Extended attributes in NAN Service Discovery Frames with invalid length values in WLAN firmware. The issue is tied to the firmware image referenced in the August 2026 Qualcomm security bulletin; no e...

CVE-2026-25289 Stack-based Buffer Overflow in WLAN Firmware

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

EUVD-2026-52737

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

CVE-2026-25289 Stack-based Buffer Overflow in WLAN Firmware

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values...

Security Bulletin:Erlang OTP SSH Path Traversal Vulnerability Affects File Attribute Modification and Privilege Escalation

Summary Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Erlang OTP ssh sshsftpd module allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon sshsftpd stores the raw, user-supplied path in...

CVE-2026-15233

The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...