CVE-2026-44498

ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operations against the 20000-sigop block limit MAXBLOCKSIGOPS, allowing it to accept blocks that zcashd rejects with bad-blk-sigops. A miner who produces such a block...

Schlix CMS code injection vulnerability

Schlix CMS is a set of open-source content management systems developed by Schlix company, based on PHP and MySQL. Version 2.2.6-6 of Schlix CMS has a code injection vulnerability. This vulnerability stems from a remote code execution issue, allowing authenticated attackers to execute arbitrary P...

PT-2026-72669

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The AK8975 driver contains four instances where uninitialized kernel stack memory leaks can occur. This happens when the function i2c smbus read i2c block data or emulated returns a valu...

CVE-2021-47964: Improper Control of Generation of Code

Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and...

com.ritense.valtimo:audit (>=13.4.0.release, <=13.22.0.release), com.ritense.valtimo:authorization (>=13.4.0.release, <=13.22.0.release) +78 more potentially affected by CVE-2026-42555 via com.ritense.valtimo:contract (>=13.4.0.release, <=13.22.0.release)

com.ritense.valtimo:contract MAVEN version =13.4.0.release, =13.4.0.release, =13.4.0.release, =13.4.0.release, =13.13.0.release, =13.4.0.release, =13.4.0.release, =13.4.0.release, =13.4.0.release, =13.4.0.release, =13.4.0.release, =13.4.0.release, =13.4.0.release, =13.4.0.release, =13.4.0.release...

com.ritense.valtimo:audit (>=13.0.0.release, <=13.25.1.release), com.ritense.valtimo:besluiten-api (>=13.0.0.release, <=13.25.1.release) +67 more potentially affected by CVE-2026-44516 via com.ritense.valtimo:web (>=13.0.0.release, <=13.25.1.release)

com.ritense.valtimo:web MAVEN version =13.0.0.release, =13.0.0.release, =13.0.0.release, =13.13.0.release, =13.0.0.release, =13.0.0.release, =13.0.0.release, =13.0.0.release, =13.0.0.release, =13.0.0.release, =13.23.0.release, =13.0.0.release, =13.0.0.release, =13.0.0.release, =13.0.0.release,...

7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +1896 more potentially affected by CVE-2026-44990 via sanitize-html (>=2.1.0, <=2.17.3)

sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =3.0.0, =1.3.0, =1.0.0, =0.2.0-a0, =1.0.0, =0.0.1, =3.7.0, =3.19.3 and more Source cves: CVE-2026-44990 Source advisory: SNYK:JS-SANITIZEHTML-16697325...

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcprov. The GOSTCTR implementation is unable to securely process more than 255 blocks of data due to keystream reuse. This issue allows an attacker to break the fundamental confidentiality of any data protected by the G3413CTRBlockCiphe...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderblockimage function. An attacker can inject arbitrary CSS into the style attribute of an image element by supplying a crafted value to the :width: or :height: option, which is insufficiently validat...

Exploit for CVE-2026-42945

cve-2026-42945-scan Static scanner for NGINX configuration fi...

Deepfake sextortion forces schools to remove student photos from websites

Schools love a good photo, whether it's from a trip to a castle, a science prize ceremony, or sports day shot from three angles. For two decades, celebratory images like these have gone straight onto school websites, captioned with a name and a grade. But those days are gone, because it's the...

CVE-2026-6252

The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-6252 Meta Field Block <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute

The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

EUVD-2026-30252

The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-6252

The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-6252

The CVE covers the WordPress plugin Meta Field Block (display-a-meta-field-as-block) with versions up to 1.5.2 affected. The root cause is insufficient input sanitization and output escaping in the tagName block attribute, enabling Stored Cross-Site Scripting. Exploitation requires authenticated ...

CVE-2026-6252 Meta Field Block <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute

The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

CVE-2026-6252: Improper Neutralization of Input During Web Page Generation

The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

PT-2026-40889

The Meta Field Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' block attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-lev...

WordPress plugin Meta Field Block has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...