CVE-2026-86790 WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-83532 Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-83532

The Custom Menu Wizard Widget WordPress plugin (versions through 3.3.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly sanitize and escape several shortcode attributes before they are rendered into HTML. This allows users with contributor-lev...

CVE-2026-83532 Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

EUVD-2026-76817

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-86790: Improper Neutralization of Input During Web Page Generation

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2026-90581

Name of the Vulnerable Software and Affected Versions WP Highlight Box versions prior to 1.1 Description Users with the contributor role and above can perform Stored Cross-Site Scripting XSS attacks. This occurs because the plugin fails to escape certain shortcode attributes before they are outpu...

PT-2026-90573

Name of the Vulnerable Software and Affected Versions Custom Menu Wizard Widget WordPress plugin versions prior to 3.3.2 Description Insufficient sanitization and escaping of several shortcode attributes before they are rendered into HTML allows users with contributor-level access and above to...

CVE-2026-83532: Improper Neutralization of Input During Web Page Generation

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-89457

A flaw was found in the s390/dasd component of the Linux kernel. An unprivileged local user can trigger a null pointer dereference by reading specific world-readable sysfs attributes while the device is being brought online. This can lead to a kernel panic, resulting in a denial of service...

CVE-2026-89626

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

CVE-2026-89626 HID: sensor: custom: Fix field sysfs group cleanup on failure

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

CVE-2026-7438

The Bold Timeline Lite WordPress plugin (all versions up to and including 1.2.8 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the supertitle and subtitle attributes of the bold_timeline_item shortcode. The root cause is insufficient input sanitization and output escaping o...

EUVD-2026-75940

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the boldtimelineitem shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-7438 Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the boldtimelineitem shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-7438 Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the boldtimelineitem shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes...

Oracle Linux 9 : ELSA-2026-66203-0: / python3.12-lxml (ELSA-2026-662030)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-662030 advisory. 4.9.3-2.1 - Fix CVE-2026-49825: add xlink:href to known HTML link attributes Resolves: RHEL-251488 Tenable has extracted the preceding description block...

PT-2026-89755

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the bold timeline item shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attribute...

Fedora 45 : perl-XML-Bare (2026-3a2db4368a)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a2db4368a advisory. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue. Fixes...

CVE-2026-88057

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...