EUVD-2026-46053

The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG...

CVE-2026-60028

The CVE-2026-60028 entry concerns the Joomla extension Quix Page Builder Pro, vulnerable to an authenticated stored XSS due to unescaped output and unsanitised SVG. The issue affects Quix Page Builder Pro (prior to version 6.2.1) where an authenticated builder user can inject scripts that execute...

EUVD-2026-46049

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

CVE-2026-44228

RT: Stored Cross-Site Scripting in versions 6.0.0–6.0.2 due to insufficient HTML escaping; an authenticated user with data‑setting permissions can inject JavaScript executed by other RT users. Fixed in 6.0.3. Affected product details, root cause, and fix are documented across CVE and NVD entries;...

CVE-2026-44228

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

CVE-2026-44228 RT: Stored Cross-Site Scripting via insufficient template escaping

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

EUVD-2026-46045

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-40187

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file .xet to the VFS /etemplates mount. The Widget::expandname method passes template widget attribute values directly into a PHP eval call...

CVE-2026-32806

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backe...

CVE-2026-34239

Chamillo LMS prior to version 1.11.40 is affected by an authenticated remote code execution vulnerability. The issue resides in the main/inc/ajax/lang.ajax.php endpoint, which is only protected by api_protect_course_script(true); any user authenticated in a course (student, teacher, DRH) can acce...

CVE-2026-34239 Chamilo Authenticated Remote Code Execution

Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by apiprotectcoursescripttrue, which means any authenticated user enrolled in a course student, teacher, DRH can reach it...

CVE-2026-40187

In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution RCE by uploading a malicious eTemplate XML file .xet to the VFS /etemplates mount. The Widget::expandname method passes template widget attribute values directly into a PHP eval call...

CVE-2026-40187

Summary (concrete details from sources): CVE-2026-40187 affects EGroupware 26.0 and earlier. An authenticated administrator can trigger OS-level RCE by uploading a malicious eTemplate XML file (.xet) to the VFS /etemplates mount. The vuln stems from Widget::expand_name() passing template widget a...

CVE-2026-44178

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate...

CVE-2026-44178 xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate...

WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Contact Form by WPForms versions = 2.0.0.1...

CVE-2026-47276

CVE-2026-47276 affects NanoMQ up to version 0.24.11: a NULL pointer dereference in properties_parse() when processing user_properties, allowing an authenticated attacker to crash the broker by sending a crafted POST to /api/v4/mqtt/publish with user_properties as a JSON array (strlen on a NULL it...

pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

CVE-2026-32824

The CVE affects dataCycle-CORE (dataCycle data management system). Before and including version 25.07.3, a low-privileged authenticated API user could supply forwardToUrl and redirectUrl during password reset/confirmation flows, which were embedded into outgoing emails without host allowlisting. ...