EUVD-2026-104011

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

PT-2026-117411

SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap host and bootstrap port fields. Attackers sending crafted requests to the Decode worker...

CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

CVE-2026-112111

The Bootstrap Shortcodes plugin for WordPress (versions before 3.4.6 ) is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The root cause is located in the bs_tcontent() handler within inc/bs_tabs.php, which emits the id attribute into an unquoted HTML attribute. Whil...

PT-2026-117162

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bs tcontent shortcode. The bs tcontent shortcode handler in inc/bs tabs.php emits the id attribute value into an unquoted HTML attribute. esc attr is applied, but it does not encode...

CVE-2026-112111: Improper Neutralization of Input During Web Page Generation

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...

TheWebShop Bootstrap Shortcodes Development Workflow Cross-site Script Vulnerabilities

TheWebShop Bootstrap Shortcodes Development Workflow: Versions prior to 3.4.6 contained a cross-site scripting vulnerability. This vulnerability occurred when the ID attribute of the bstcontent shortcode was output into HTML attributes without proper quotation marks, and spaces were not encoded...

CVE-2026-71497 affecting package javapackages-bootstrap for versions less than 1.14.0-5

CVE-2026-71497 affecting package javapackages-bootstrap for versions less than 1.14.0-5. A patched version of the package is available...

CVE-2026-67237

A flaw was found in rabbitmq-server. When Open Authorization OAuth is enabled for the management interface, the application fails to properly sanitize authentication tokens before embedding them into the bootstrap script. A remote attacker could exploit this cross-site scripting XSS vulnerability...

BIT-MYSQL-CLIENT-2026-107818 MariaDB: environment injection via wsrep bootstrap in the mariadb.service file

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

BIT-MARIADB-MIN-2026-107818 MariaDB: environment injection via wsrep bootstrap in the mariadb.service file

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

BIT-MARIADB-2026-107818 MariaDB: environment injection via wsrep bootstrap in the mariadb.service file

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

Security Bulletin: IBM Engineering Lifecycle Optimization - Engineering Publishing affected by a Cross-Site Scripting (XSS) vulnerability in Bootstrap (CVE-2024-6485)

Summary A security vulnerability CVE-2024-6485 has been identified in Bootstrap that may affect IBM Engineering Lifecycle Optimization - Engineering Publishing. The vulnerability exists in the button plugin's data-loading-text attribute, where improper input neutralization could allow attackers t...

CVE-2026-102061

A Stack-based Buffer Overflow vulnerability exists in the phone-home daemon (phcd) of Juniper Networks Junos OS and Junos OS Evolved . An adjacent unauthenticated attacker can execute arbitrary code as root by sending a crafted DHCP SZTP bootstrap message . This vulnerability specifically impacts...

AZL-108363 CVE-2026-110591 affecting package javapackages-bootstrap 1.14.0-4

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded...

AZL-108381 CVE-2026-110270 affecting package javapackages-bootstrap 1.14.0-4

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O2^n memory allocation, causing an...

@nk-spirit/nk-ngx-bootstrap (7.1.16) potentially affected by CVE-2026-101895 via @angular/platform-server (11.2.0)

@angular/platform-server NPM version 11.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @nk-spirit/nk-ngx-bootstrap 7.1.16 Source cves: CVE-2026-101895 Source advisory: MEND:CVE-2026-101895...